[Feature][T8TSK-341] merge offical patch for ubifs from mtk
Only Configure: No
Affected branch: ALL
Affected module: kernel
Is it affected on both ZXIC and MTK: only MTK
Self-test: Yes
Doc Update: No
Change-Id: I2c099960dbacdb208deb65167ae264eddaa7858e
diff --git a/src/kernel/linux/v4.19/fs/ubifs/io.c b/src/kernel/linux/v4.19/fs/ubifs/io.c
index 099bec9..fab29f8 100644
--- a/src/kernel/linux/v4.19/fs/ubifs/io.c
+++ b/src/kernel/linux/v4.19/fs/ubifs/io.c
@@ -237,7 +237,7 @@
int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
int offs, int quiet, int must_chk_crc)
{
- int err = -EINVAL, type, node_len;
+ int err = -EINVAL, type, node_len, dump_node = 1;
uint32_t crc, node_crc, magic;
const struct ubifs_ch *ch = buf;
@@ -290,10 +290,22 @@
out_len:
if (!quiet)
ubifs_err(c, "bad node length %d", node_len);
+ if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ)
+ dump_node = 0;
out:
if (!quiet) {
ubifs_err(c, "bad node at LEB %d:%d", lnum, offs);
- ubifs_dump_node(c, buf);
+ if (dump_node) {
+ ubifs_dump_node(c, buf);
+ } else {
+ int safe_len = min3(node_len, c->leb_size - offs,
+ (int)UBIFS_MAX_DATA_NODE_SZ);
+ pr_err("\tprevent out-of-bounds memory access\n");
+ pr_err("\ttruncated data node length %d\n", safe_len);
+ pr_err("\tcorrupted data node:\n");
+ print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1,
+ buf, safe_len, 0);
+ }
dump_stack();
}
return err;