aboutsummaryrefslogtreecommitdiffstats
path: root/fs/ubifs/io.c
diff options
context:
space:
mode:
authorPaolo Bonzini <pbonzini@redhat.com>2020-04-21 09:37:13 -0400
committerPaolo Bonzini <pbonzini@redhat.com>2020-04-21 09:37:13 -0400
commit3bda03865fcaf5e30248bf4b7b37a81f6966caf9 (patch)
tree40e1edb696326bfbd028afc271e7272d87b6b506 /fs/ubifs/io.c
parentkvm: Disable objtool frame pointer checking for vmenter.S (diff)
parentMAINTAINERS: add a reviewer for KVM/s390 (diff)
downloadlinux-dev-3bda03865fcaf5e30248bf4b7b37a81f6966caf9.tar.xz
linux-dev-3bda03865fcaf5e30248bf4b7b37a81f6966caf9.zip
Merge tag 'kvm-s390-master-5.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-master
KVM: s390: Fix for 5.7 and maintainer update - Silence false positive lockdep warning - add Claudio as reviewer
Diffstat (limited to 'fs/ubifs/io.c')
-rw-r--r--fs/ubifs/io.c16
1 files changed, 14 insertions, 2 deletions
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index 8ceb51478800..7e4bfaf2871f 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -225,7 +225,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum)
int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
int offs, int quiet, int must_chk_crc)
{
- int err = -EINVAL, type, node_len;
+ int err = -EINVAL, type, node_len, dump_node = 1;
uint32_t crc, node_crc, magic;
const struct ubifs_ch *ch = buf;
@@ -278,10 +278,22 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
out_len:
if (!quiet)
ubifs_err(c, "bad node length %d", node_len);
+ if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ)
+ dump_node = 0;
out:
if (!quiet) {
ubifs_err(c, "bad node at LEB %d:%d", lnum, offs);
- ubifs_dump_node(c, buf);
+ if (dump_node) {
+ ubifs_dump_node(c, buf);
+ } else {
+ int safe_len = min3(node_len, c->leb_size - offs,
+ (int)UBIFS_MAX_DATA_NODE_SZ);
+ pr_err("\tprevent out-of-bounds memory access\n");
+ pr_err("\ttruncated data node length %d\n", safe_len);
+ pr_err("\tcorrupted data node:\n");
+ print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1,
+ buf, safe_len, 0);
+ }
dump_stack();
}
return err;