mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
ubifs: wbuf: Don't leak kernel memory to flash
commit20f1431160
upstream. Write buffers use a kmalloc()'ed buffer, they can leak up to seven bytes of kernel memory to flash if writes are not aligned. So use ubifs_pad() to fill these gaps with padding bytes. This was never a problem while scanning because the scanner logic manually aligns node lengths and skips over these gaps. Cc: <stable@vger.kernel.org> Fixes:1e51764a3c
("UBIFS: add new flash file system") Signed-off-by: Richard Weinberger <richard@nod.at> Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
32825fe72c
commit
ea1e4ba032
1 changed files with 11 additions and 2 deletions
|
@ -319,7 +319,7 @@ void ubifs_pad(const struct ubifs_info *c, void *buf, int pad)
|
|||
{
|
||||
uint32_t crc;
|
||||
|
||||
ubifs_assert(c, pad >= 0 && !(pad & 7));
|
||||
ubifs_assert(c, pad >= 0);
|
||||
|
||||
if (pad >= UBIFS_PAD_NODE_SZ) {
|
||||
struct ubifs_ch *ch = buf;
|
||||
|
@ -764,6 +764,10 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
|
|||
* write-buffer.
|
||||
*/
|
||||
memcpy(wbuf->buf + wbuf->used, buf, len);
|
||||
if (aligned_len > len) {
|
||||
ubifs_assert(c, aligned_len - len < 8);
|
||||
ubifs_pad(c, wbuf->buf + wbuf->used + len, aligned_len - len);
|
||||
}
|
||||
|
||||
if (aligned_len == wbuf->avail) {
|
||||
dbg_io("flush jhead %s wbuf to LEB %d:%d",
|
||||
|
@ -856,13 +860,18 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
|
|||
}
|
||||
|
||||
spin_lock(&wbuf->lock);
|
||||
if (aligned_len)
|
||||
if (aligned_len) {
|
||||
/*
|
||||
* And now we have what's left and what does not take whole
|
||||
* max. write unit, so write it to the write-buffer and we are
|
||||
* done.
|
||||
*/
|
||||
memcpy(wbuf->buf, buf + written, len);
|
||||
if (aligned_len > len) {
|
||||
ubifs_assert(c, aligned_len - len < 8);
|
||||
ubifs_pad(c, wbuf->buf + len, aligned_len - len);
|
||||
}
|
||||
}
|
||||
|
||||
if (c->leb_size - wbuf->offs >= c->max_write_size)
|
||||
wbuf->size = c->max_write_size;
|
||||
|
|
Loading…
Reference in a new issue