diff options
| author | Zhihao Cheng <chengzhihao1@huawei.com> | 2020-06-16 09:11:44 +0200 |
|---|---|---|
| committer | Richard Weinberger <richard@nod.at> | 2020-12-13 22:12:32 +0100 |
| commit | a33e30a0e023e9d1866866ca895c7789f48445e7 (patch) | |
| tree | 383b2fd9b04365a17ed31c4b624d278cf8e23607 /fs/ubifs/tnc.c | |
| parent | Revert "ubifs: Fix out-of-bounds memory access caused by abnormal value of no... (diff) | |
| download | linux-a33e30a0e023e9d1866866ca895c7789f48445e7.tar.xz linux-a33e30a0e023e9d1866866ca895c7789f48445e7.zip | |
ubifs: Pass node length in all node dumping callers
Function ubifs_dump_node() has been modified to avoid memory oob
accessing while dumping node, node length (corresponding to the
size of allocated memory for node) should be passed into all node
dumping callers.
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Diffstat (limited to 'fs/ubifs/tnc.c')
| -rw-r--r-- | fs/ubifs/tnc.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c index c90b1c7c6819..488f3da7a6c6 100644 --- a/fs/ubifs/tnc.c +++ b/fs/ubifs/tnc.c @@ -316,7 +316,7 @@ static int lnc_add(struct ubifs_info *c, struct ubifs_zbranch *zbr, err = ubifs_validate_entry(c, dent); if (err) { dump_stack(); - ubifs_dump_node(c, dent); + ubifs_dump_node(c, dent, zbr->len); return err; } @@ -349,7 +349,7 @@ static int lnc_add_directly(struct ubifs_info *c, struct ubifs_zbranch *zbr, err = ubifs_validate_entry(c, node); if (err) { dump_stack(); - ubifs_dump_node(c, node); + ubifs_dump_node(c, node, zbr->len); return err; } @@ -1699,7 +1699,7 @@ static int validate_data_node(struct ubifs_info *c, void *buf, goto out_err; } - err = ubifs_check_node(c, buf, zbr->lnum, zbr->offs, 0, 0); + err = ubifs_check_node(c, buf, zbr->len, zbr->lnum, zbr->offs, 0, 0); if (err) { ubifs_err(c, "expected node type %d", UBIFS_DATA_NODE); goto out; @@ -1733,7 +1733,7 @@ out_err: err = -EINVAL; out: ubifs_err(c, "bad node at LEB %d:%d", zbr->lnum, zbr->offs); - ubifs_dump_node(c, buf); + ubifs_dump_node(c, buf, zbr->len); dump_stack(); return err; } |