Ajesh Kunhipurayil Vijayan 41bf1a24c1 jffs2: Fix crash due to truncation of csize ... mounting JFFS2 partition sometimes crashes with this call trace: [ 1322.240000] Kernel bug detected[#1]: [ 1322.244000] Cpu 2 [ 1322.244000] $ 0 : 0000000000000000 0000000000000018 000000003ff00070 0000000000000001 [ 1322.252000] $ 4 : 0000000000000000 c0000000f3980150 0000000000000000 0000000000010000 [ 1322.260000] $ 8 : ffffffffc09cd5f8 0000000000000001 0000000000000088 c0000000ed300de8 [ 1322.268000] $12 : e5e19d9c5f613a45 ffffffffc046d464 0000000000000000 66227ba5ea67b74e [ 1322.276000] $16 : c0000000f1769c00 c0000000ed1e0200 c0000000f3980150 0000000000000000 [ 1322.284000] $20 : c0000000f3a80000 00000000fffffffc c0000000ed2cfbd8 c0000000f39818f0 [ 1322.292000] $24 : 0000000000000004 0000000000000000 [ 1322.300000] $28 : c0000000ed2c0000 c0000000ed2cfab8 0000000000010000 ffffffffc039c0b0 [ 1322.308000] Hi : 000000000000023c [ 1322.312000] Lo : 000000000003f802 [ 1322.316000] epc : ffffffffc039a9f8 check_tn_node+0x88/0x3b0 [ 1322.320000] Not tainted [ 1322.324000] ra : ffffffffc039c0b0 jffs2_do_read_inode_internal+0x1250/0x1e48 [ 1322.332000] Status: 5400f8e3 KX SX UX KERNEL EXL IE [ 1322.336000] Cause : 00800034 [ 1322.340000] PrId : 000c1004 (Netlogic XLP) [ 1322.344000] Modules linked in: [ 1322.348000] Process jffs2_gcd_mtd7 (pid: 264, threadinfo=c0000000ed2c0000, task=c0000000f0e68dd8, tls=0000000000000000) [ 1322.356000] Stack : c0000000f1769e30 c0000000ed010780 c0000000ed010780 c0000000ed300000 c0000000f1769c00 c0000000f3980150 c0000000f3a80000 00000000fffffffc c0000000ed2cfbd8 ffffffffc039c0b0 ffffffffc09c6340 0000000000001000 0000000000000dec ffffffffc016c9d8 c0000000f39805a0 c0000000f3980180 0000008600000000 0000000000000000 0000000000000000 0000000000000000 0001000000000dec c0000000f1769d98 c0000000ed2cfb18 0000000000010000 0000000000010000 0000000000000044 c0000000f3a80000 c0000000f1769c00 c0000000f3d207a8 c0000000f1769d98 c0000000f1769de0 ffffffffc076f9c0 0000000000000009 0000000000000000 0000000000000000 ffffffffc039cf90 0000000000000017 ffffffffc013fbdc 0000000000000001 000000010003e61c ... [ 1322.424000] Call Trace: [ 1322.428000] [<ffffffffc039a9f8>] check_tn_node+0x88/0x3b0 [ 1322.432000] [<ffffffffc039c0b0>] jffs2_do_read_inode_internal+0x1250/0x1e48 [ 1322.440000] [<ffffffffc039cf90>] jffs2_do_crccheck_inode+0x70/0xd0 [ 1322.448000] [<ffffffffc03a1b80>] jffs2_garbage_collect_pass+0x160/0x870 [ 1322.452000] [<ffffffffc03a392c>] jffs2_garbage_collect_thread+0xdc/0x1f0 [ 1322.460000] [<ffffffffc01541c8>] kthread+0xb8/0xc0 [ 1322.464000] [<ffffffffc0106d18>] kernel_thread_helper+0x10/0x18 [ 1322.472000] [ 1322.472000] Code: 67bd0050 94a4002c 2c830001 <00038036> de050218 2403fffc 0080a82d 00431824 24630044 [ 1322.480000] ---[ end trace b052bb90e97dfbf5 ]--- The variable csize in structure jffs2_tmp_dnode_info is of type uint16_t, but it is used to hold the compressed data length(csize) which is declared as uint32_t. So, when the value of csize exceeds 16bits, it gets truncated when assigned to tn->csize. This is causing a kernel BUG. Changing the definition of csize in jffs2_tmp_dnode_info to uint32_t fixes the issue. Signed-off-by: Ajesh Kunhipurayil Vijayan <ajesh@broadcom.com> Signed-off-by: Kamlakant Patel <kamlakant.patel@broadcom.com> Cc: <stable@vger.kernel.org> Signed-off-by: Brian Norris <computersforpeace@gmail.com>		2014-03-10 22:42:28 -07:00
..
9p	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-01-28 08:38:04 -08:00
adfs	adfs: delayed freeing of sbi	2013-10-24 23:43:27 -04:00
affs	affs: use ->kill_sb() to simplify ->put_super() and failure exits of ->mount()	2014-01-25 03:13:01 -05:00
afs	afs: proc cells and rootcell are writeable	2014-02-01 10:59:39 -08:00
autofs4	autofs: fix symlinks aren't checked for expiry	2014-01-23 16:36:59 -08:00
befs	befs: iget_locked() doesn't return an ERR_PTR	2014-01-25 03:14:38 -05:00
bfs	truncate: drop 'oldsize' truncate_pagecache() parameter	2013-09-12 15:38:02 -07:00
btrfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2014-02-16 11:05:27 -08:00
cachefiles	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-11-13 15:34:18 +09:00
ceph	ceph: fix __dcache_readdir()	2014-02-17 12:37:13 -08:00
cifs	Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6	2014-02-17 13:50:11 -08:00
coda	coda_revalidate_inode(): switch to passing inode...	2013-11-09 00:16:21 -05:00
configfs	configfs: fix race between dentry put and lookup	2013-11-21 16:42:27 -08:00
cramfs	cramfs: take headers to fs/cramfs	2014-01-25 03:13:02 -05:00
debugfs	debugfs: use list_next_entry() in debugfs_remove_recursive()	2013-11-13 12:09:24 +09:00
devpts	devpts: plug the memory leak in kill_sb	2013-11-13 12:09:36 +09:00
dlm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-01-25 11:17:34 -08:00
ecryptfs	ecryptfs: fix failure handling in ->readlink()	2014-01-25 03:13:00 -05:00
efivarfs	consolidate simple ->d_delete() instances	2013-11-15 22:04:17 -05:00
efs	efs: get rid of ->put_super()	2014-01-25 03:13:02 -05:00
exofs	exofs: Print less in r4w	2014-01-23 18:54:14 +02:00
exportfs	exportfs: fix quadratic behavior in filehandle lookup	2013-11-09 00:16:38 -05:00
ext2	ext2/3/4: use generic posix ACL infrastructure	2014-01-25 23:58:19 -05:00
ext3	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-01-28 08:38:04 -08:00
ext4	ext4: don't leave i_crtime.tv_sec uninitialized	2014-02-16 19:29:32 -05:00
f2fs	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
fat	fat: rcu-delay unloading nls and freeing sbi	2013-10-24 23:43:28 -04:00
freevxfs
fscache	FS-Cache: Handle removal of unadded object to the fscache_object_list rb tree	2014-02-17 13:47:35 -08:00
fuse	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-01-28 08:38:04 -08:00
gfs2	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
hfs	fs/hfs/btree.h: remove duplicate defines	2013-11-13 12:09:32 +09:00
hfsplus	hfsplus: fix remount issue	2014-03-04 07:55:49 -08:00
hostfs	um: hostfs: make functions static	2014-01-26 11:51:09 +01:00
hpfs	hpfs: optimize quad buffer loading	2014-02-02 16:24:07 -08:00
hppfs	clean up scary strncpy(dst, src, strlen(src)) uses	2013-07-03 16:07:41 -07:00
hugetlbfs	cope with potentially long ->d_dname() output for shmem/hugetlb	2013-08-24 12:10:17 -04:00
isofs	isofs: don't pass dentry to isofs_hash{i,}_common()	2013-10-24 23:34:59 -04:00
jbd	jbd: Revise KERN_EMERG error messages	2013-12-04 12:27:46 +01:00
jbd2	jbd2: fix use after free in jbd2_journal_start_reserved()	2014-02-17 20:33:01 -05:00
jffs2	jffs2: Fix crash due to truncation of csize	2014-03-10 22:42:28 -07:00
jfs	jfs: set i_ctime when setting ACL	2014-02-13 15:56:05 -06:00
kernfs	sysfs: fix namespace refcnt leak	2014-02-25 07:37:52 -08:00
lockd	lockd: send correct lock when granting a delayed lock.	2014-02-13 14:55:02 -05:00
logfs	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
minix	fs/minix: Drop dependency on H8300	2013-09-16 18:20:25 -07:00
ncpfs	ncpfs: rcu-delay unload_nls() and freeing ncp_server	2013-10-24 23:43:28 -04:00
nfs	NFS client bugfixes for Linux 3.14	2014-03-09 19:17:39 -07:00
nfs_common
nfsd	nfsd4: fix acl buffer overrun	2014-02-11 13:48:11 -05:00
nilfs2	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
nls	nls: have register_nls() set ->owner	2014-01-25 03:14:05 -05:00
notify	fsnotify: Allocate overflow events with proper type	2014-02-25 11:18:06 +01:00
ntfs	fix O_SYNC|O_APPEND syncing the wrong range on write()	2014-02-09 15:18:09 -05:00
ocfs2	ocfs2: fix quota file corruption	2014-03-04 07:55:48 -08:00
omfs	truncate: drop 'oldsize' truncate_pagecache() parameter	2013-09-12 15:38:02 -07:00
openpromfs
proc	mm: close PageTail race	2014-03-04 07:55:47 -08:00
pstore	pstore: Don't allow high traffic options on fragile devices	2013-12-20 13:12:01 -08:00
qnx4	qnx4: clean qnx4_fill_super() up	2014-01-25 03:13:03 -05:00
qnx6
quota	quota: Fix race between dqput() and dquot_scan_active()	2014-02-20 21:57:04 +01:00
ramfs	fs/ramfs: move ramfs_aops to inode.c	2014-01-23 16:36:58 -08:00
reiserfs	reiserfs: fix utterly brain-damaged indentation.	2014-02-17 13:46:33 -08:00
romfs	romfs: fix returm err while getting inode in fill_super	2014-01-23 16:37:04 -08:00
squashfs	Squashfs: fix failure to unlock pages on decompress error	2013-11-24 01:02:50 +00:00
sysfs	sysfs: fix namespace refcnt leak	2014-02-25 07:37:52 -08:00
sysv	sysv: Add forgotten superblock lock init for v7 fs	2013-09-29 22:02:02 -04:00
ubifs	fs/ubifs: use rbtree postorder iteration helper instead of opencoding	2014-01-23 16:37:03 -08:00
udf	udf: Fix data corruption on file type conversion	2014-02-20 21:56:00 +01:00
ufs	truncate: drop 'oldsize' truncate_pagecache() parameter	2013-09-12 15:38:02 -07:00
xfs	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs	2014-02-27 10:37:22 -08:00
aio.c	Merge git://git.kvack.org/~bcrl/aio-next	2013-12-22 11:03:49 -08:00
anon_inodes.c	... and kill anon_inode_getfile_private()	2013-11-09 00:16:28 -05:00
attr.c	fs: fix iversion handling	2013-12-05 16:36:21 -06:00
bad_inode.c
binfmt_aout.c	dump_skip(): dump_seek() replacement taking coredump_params	2013-11-09 00:16:26 -05:00
binfmt_elf.c	fs: binfmt_elf: remove unused defines INTERPRETER_NONE and INTERPRETER_ELF	2014-01-23 16:36:58 -08:00
binfmt_elf_fdpic.c	elf{,_fdpic} coredump: get rid of pointless if (siginfo->si_signo)	2013-11-09 00:16:30 -05:00
binfmt_em86.c	file->f_op is never NULL...	2013-10-24 23:34:54 -04:00
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
binfmt_som.c
bio-integrity.c	bio-integrity: Drop bio_integrity_verify BUG_ON in post bip->bip_iter world	2014-02-21 15:56:36 -08:00
bio.c	block: Fix cloning of discard/write same bios	2014-02-11 08:40:45 -07:00
block_dev.c	a trivial writeback fix	2013-09-13 23:06:40 -04:00
buffer.c	mm: __set_page_dirty uses spin_lock_irqsave instead of spin_lock_irq	2014-02-06 13:48:51 -08:00
char_dev.c	Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block	2013-11-14 12:08:14 +09:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c	fs/compat_ioctl.c: fix an underflow issue (harmless)	2014-01-21 16:19:42 -08:00
coredump.c	coredump: make __get_dumpable/get_dumpable inline, kill fs/coredump.h	2014-01-23 16:37:01 -08:00
dcache.c	__dentry_path() fixes	2014-01-26 12:37:55 -05:00
dcookies.c	fs/compat: fix lookup_dcookie() parameter handling	2014-01-29 16:22:40 -08:00
direct-io.c	block: Abstract out bvec iterator	2013-11-23 22:33:47 -08:00
drop_caches.c	shrinker: add node awareness	2013-09-10 18:56:31 -04:00
eventfd.c	eventfd_ctx_fdget(): use fdget() instead of fget()	2014-01-25 03:13:04 -05:00
eventpoll.c	epoll: do not take the nested ep->mtx on EPOLL_CTL_DEL	2014-01-02 14:40:30 -08:00
exec.c	execve: use 'struct filename *' for executable name passing	2014-02-05 12:54:53 -08:00
fcntl.c	file->f_op is never NULL...	2013-10-24 23:34:54 -04:00
fhandle.c
file.c	fs/file.c:fdtable: avoid triggering OOMs from alloc_fdmem	2014-02-10 16:01:41 -08:00
file_table.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-11-13 15:34:18 +09:00
filesystems.c
fs-writeback.c	Revert "writeback: do not sync data dirtied after sync start"	2014-02-22 02:02:28 +01:00
fs_struct.c	seqcount: Add lockdep functionality to seqcount/seqlock structures	2013-11-06 12:40:26 +01:00
inode.c	locks: break delegations on any attribute modification	2013-11-09 00:16:44 -05:00
internal.h	get rid of s_files and files_lock	2013-11-09 00:16:20 -05:00
ioctl.c	file->f_op is never NULL...	2013-10-24 23:34:54 -04:00
ioprio.c
Kconfig	fs: remove generic_acl	2014-01-26 08:26:40 -05:00
Kconfig.binfmt
libfs.c	consolidate simple ->d_delete() instances	2013-11-15 22:04:17 -05:00
locks.c	locks: missing unlock on error in generic_add_lease()	2013-11-13 07:30:53 -05:00
Makefile	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-01-28 08:38:04 -08:00
mbcache.c	fs: convert fs shrinkers to new scan/count API	2013-09-10 18:56:31 -04:00
mount.h	vfs: Is mounted should be testing mnt_ns for NULL or error.	2014-01-26 08:26:42 -05:00
mpage.c	block: Abstract out bvec iterator	2013-11-23 22:33:47 -08:00
namei.c	execve: use 'struct filename *' for executable name passing	2014-02-05 12:54:53 -08:00
namespace.c	Driver core / sysfs patches for 3.14-rc1	2014-01-20 15:49:44 -08:00
no-block.c
open.c	locks: break delegations on any attribute modification	2013-11-09 00:16:44 -05:00
pipe.c	fs/pipe.c: skip file_update_time on frozen fs	2014-01-23 16:37:00 -08:00
pnode.c	split __lookup_mnt() in two functions	2013-10-24 23:35:00 -04:00
pnode.h	vfs: Don't copy mount bind mounts of /proc/<pid>/ns/mnt between namespaces	2013-08-26 18:42:15 -07:00
posix_acl.c	fs: get_acl() must be allowed to return EOPNOTSUPP	2014-02-03 17:12:37 -05:00
proc_namespace.c	fs/proc_namespace.c: simplify testing nsp and nsp->mnt_ns	2014-01-23 16:37:02 -08:00
read_write.c	fs/compat: fix parameter handling for compat readv/writev syscalls	2014-01-29 16:22:39 -08:00
readdir.c	file->f_op is never NULL...	2013-10-24 23:34:54 -04:00
select.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-11-13 15:34:18 +09:00
seq_file.c	seq_file: always clear m->count when we free m->buf	2013-11-18 19:07:53 -08:00
signalfd.c
splice.c	fuse: fix pipe_buf_operations	2014-01-22 19:36:57 +01:00
stack.c
stat.c	vfs: split out vfs_getattr_nosec	2013-11-09 00:16:31 -05:00
statfs.c	vfs: allow O_PATH file descriptors for fstatfs()	2013-10-12 13:12:31 -07:00
super.c	fs/super.c: sync ro remount after blocking writers	2014-01-31 14:29:36 -05:00
sync.c	Revert "writeback: do not sync data dirtied after sync start"	2014-02-22 02:02:28 +01:00
timerfd.c
utimes.c	locks: break delegations on any attribute modification	2013-11-09 00:16:44 -05:00
xattr.c