Revert "ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len" (c8be0975) · Commits · 戴 / test

fs/ubifs/io.c

+2 −14

Original line number	Diff line number	Diff line
		@@ -225,7 +225,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum)
		int ubifs_check_node(const struct ubifs_info c, const void buf, int lnum,
		int offs, int quiet, int must_chk_crc)
		{
		int err = -EINVAL, type, node_len, dump_node = 1;
		int err = -EINVAL, type, node_len;
		uint32_t crc, node_crc, magic;
		const struct ubifs_ch *ch = buf;

		@@ -278,22 +278,10 @@ int ubifs_check_node(const struct ubifs_info c, const void buf, int lnum,
		out_len:
		if (!quiet)
		ubifs_err(c, "bad node length %d", node_len);
		if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ)
		dump_node = 0;
		out:
		if (!quiet) {
		ubifs_err(c, "bad node at LEB %d:%d", lnum, offs);
		if (dump_node) {
		ubifs_dump_node(c, buf);
		} else {
		int safe_len = min3(node_len, c->leb_size - offs,
		(int)UBIFS_MAX_DATA_NODE_SZ);
		pr_err("\tprevent out-of-bounds memory access\n");
		pr_err("\ttruncated data node length %d\n", safe_len);
		pr_err("\tcorrupted data node:\n");
		print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1,
		buf, safe_len, 0);
		}
		dump_stack();
		}
		return err;