linux-kernel - Re: ubifs mount failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191203104558.vpqav3oxsydoe4aw@pengutronix.de>
Date:   Tue, 3 Dec 2019 11:45:58 +0100
From:   Sascha Hauer <s.hauer@...gutronix.de>
To:     naga suresh kumar <nagasureshkumarrelli@...il.com>
Cc:     Richard Weinberger <richard@....at>,
        Naga Sureshkumar Relli <nagasure@...inx.com>,
        Miquel Raynal <miquel.raynal@...tlin.com>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Michal Simek <michals@...inx.com>,
        siva durga paladugu <siva.durga.paladugu@...ilnx.com>,
        linux-mtd <linux-mtd@...ts.infradead.org>
Subject: Re: ubifs mount failure

On Tue, Dec 03, 2019 at 04:06:12PM +0530, naga suresh kumar wrote:
> Hi Richard,
> 
> On Tue, Dec 3, 2019 at 2:40 PM Richard Weinberger <richard@....at> wrote:
> >
> > ----- Ursprüngliche Mail -----
> > > Von: "Naga Sureshkumar Relli" <nagasure@...inx.com>
> > > https://elixir.bootlin.com/linux/v5.4/source/fs/ubifs/sb.c#L164
> > > we are trying to allocate 4325376 (~4MB)
> >
> > 4MiB? Is ->min_io_size that large?
> if you see https://elixir.bootlin.com/linux/latest/source/fs/ubifs/sb.c#L164
> The size is actually ALIGN(tmp, c->min_io_size).
> Here tmp is of 4325376 Bytes and min_io_size is 16384 Bytes

'tmp' contains bogus values. Try this:

----------------------------8<--------------------------------

>From 34f687fce189085f55706b4cddcb288a08f4ee06 Mon Sep 17 00:00:00 2001
From: Sascha Hauer <s.hauer@...gutronix.de>
Date: Tue, 3 Dec 2019 11:41:20 +0100
Subject: [PATCH] ubifs: Fix wrong memory allocation

In create_default_filesystem() when we allocate the idx node we must use
the idx_node_size we calculated just one line before, not tmp, which
contains completely other data.

Fixes: c4de6d7e4319 ("ubifs: Refactor create_default_filesystem()")
Reported-by: Naga Sureshkumar Relli <nagasure@...inx.com>
Signed-off-by: Sascha Hauer <s.hauer@...gutronix.de>
---
 fs/ubifs/sb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c
index a551eb3e9b89..6681c18e52b8 100644
--- a/fs/ubifs/sb.c
+++ b/fs/ubifs/sb.c
@@ -161,7 +161,7 @@ static int create_default_filesystem(struct ubifs_info *c)
 	sup = kzalloc(ALIGN(UBIFS_SB_NODE_SZ, c->min_io_size), GFP_KERNEL);
 	mst = kzalloc(c->mst_node_alsz, GFP_KERNEL);
 	idx_node_size = ubifs_idx_node_sz(c, 1);
-	idx = kzalloc(ALIGN(tmp, c->min_io_size), GFP_KERNEL);
+	idx = kzalloc(ALIGN(idx_node_size, c->min_io_size), GFP_KERNEL);
 	ino = kzalloc(ALIGN(UBIFS_INO_NODE_SZ, c->min_io_size), GFP_KERNEL);
 	cs = kzalloc(ALIGN(UBIFS_CS_NODE_SZ, c->min_io_size), GFP_KERNEL);
 
-- 
2.24.0


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |