leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ubifs: Fix lockup/crash when reading files

Browse Source 
Commit b1a14f8a1c ("UBIFS: Change ubifsload to not read beyond the
requested size") added optimization to do not read more bytes than it is
really needed. But this commit introduced incorrect handling of the hole at
the end of file. This logic cause U-Boot to crash or lockup when trying to
read from the ubifs filesystem.

When read_block() call returns -ENOENT error (not an error, but the hole)
then dn-> structure is not filled and contain garbage. So using of dn->size
for memcpy() argument cause that U-Boot tries to copy unspecified amount of
bytes from possible unmapped memory. Which randomly cause lockup of P2020
CPU.

Fix this issue by copying UBIFS_BLOCK_SIZE bytes from read buffer when
dn->size is not available. UBIFS_BLOCK_SIZE is the size of the buffer
itself and read_block() fills buffer by zeros when it returns -ENOENT.

This patch fixes ubifsload on P2020.

Fixes: b1a14f8a1c ("UBIFS: Change ubifsload to not read beyond the requested size")
Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Stefan Roese <sr@denx.de>
This commit is contained in:
Pali Rohár 2022-05-17 22:45:28 +02:00 committed by Tom Rini
parent 3053b78146
commit 339f652992
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/ubifs/ubifs.c
View File

@ -788,6 +788,8 @@ static int do_readpage(struct ubifs_info *c, struct inode *inode,
if (last_block_size) if (last_block_size)
dlen = last_block_size; dlen = last_block_size;
else if (ret)
dlen = UBIFS_BLOCK_SIZE;
else else
dlen = le32_to_cpu(dn->size); dlen = le32_to_cpu(dn->size);