[PATCH] Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()"

[PATCH] Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()"

[Joel Stanley]

This reverts commit f2538f999345405f7d2e1194c0c8efa4e11f7b3a. The patch
stopped JFFS2 from being able to mount an existing filesystem with the
following errors:

 jffs2: error: (77) jffs2_build_inode_fragtree: Add node to tree failed -22
 jffs2: error: (77) jffs2_do_read_inode_internal: Failed to build final fragtree for inode #5377: error -22

Fixes: f2538f999345 ("jffs2: Fix possible null-pointer dereferences...")
Cc: stable@vger.kernel.org
Suggested-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
---
5.4 cannot mount (some?) jffs2 filesystems without this fix. Hou pointed
this out[1] a while back but the fix didn't make it in. It's still
broken in -next.

[1] https://lore.kernel.org/lkml/2758feea-8d6e-c690-5cac-d42213f2024b@huawei.com/

 fs/jffs2/nodelist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/jffs2/nodelist.c b/fs/jffs2/nodelist.c
index 021a4a2190ee..b86c78d178c6 100644
--- a/fs/jffs2/nodelist.c
+++ b/fs/jffs2/nodelist.c
@@ -226,7 +226,7 @@ static int jffs2_add_frag_to_fragtree(struct jffs2_sb_info *c, struct rb_root *r
 		lastend = this->ofs + this->size;
 	} else {
 		dbg_fragtree2("lookup gave no frag\n");
-		return -EINVAL;
+		lastend = 0;
 	}
 
 	/* See if we ran off the end of the fragtree */
-- 
2.24.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH] Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()"

[Richard Weinberger]

----- Ursprüngliche Mail -----
> Von: "Joel Stanley" <joel@jms.id.au>
> An: "David Woodhouse" <dwmw2@infradead.org>, "richard" <richard@nod.at>, "Jia-Ju Bai" <baijiaju1990@gmail.com>, "Al
> Viro" <viro@zeniv.linux.org.uk>, "OpenBMC Maillist" <openbmc@lists.ozlabs.org>, "linux-mtd"
> <linux-mtd@lists.infradead.org>, "linux-kernel" <linux-kernel@vger.kernel.org>
> CC: "stable" <stable@vger.kernel.org>, "Hou Tao" <houtao1@huawei.com>
> Gesendet: Freitag, 29. November 2019 01:19:30
> Betreff: [PATCH] Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()"

> This reverts commit f2538f999345405f7d2e1194c0c8efa4e11f7b3a. The patch
> stopped JFFS2 from being able to mount an existing filesystem with the
> following errors:
> 
> jffs2: error: (77) jffs2_build_inode_fragtree: Add node to tree failed -22
> jffs2: error: (77) jffs2_do_read_inode_internal: Failed to build final fragtree
> for inode #5377: error -22
> 
> Fixes: f2538f999345 ("jffs2: Fix possible null-pointer dereferences...")
> Cc: stable@vger.kernel.org
> Suggested-by: Hou Tao <houtao1@huawei.com>
> Signed-off-by: Joel Stanley <joel@jms.id.au>
> ---
> 5.4 cannot mount (some?) jffs2 filesystems without this fix. Hou pointed
> this out[1] a while back but the fix didn't make it in. It's still
> broken in -next.

queued into -next.

Thanks,
//richard

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

[PATCH] Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()"

[Alexander Sverdlin]

This reverts commit f2538f999345405f7d2e1194c0c8efa4e11f7b3a.

Looks like NULL this is never dereferenced in reality because the function
returns earlier with "return no_overlapping_node(...)".

That's how mounting of a fully normal JFFS2 as rootfs looks like after the
patch:

Run /sbin/init as init process
jffs2: error: (1) jffs2_build_inode_fragtree: Add node to tree failed -22
jffs2: error: (1) jffs2_do_read_inode_internal: Failed to build final fragtree for inode #14: error -22
jffs2: iget() failed for ino #14
jffs2: error: (36) jffs2_build_inode_fragtree: Add node to tree failed -22
Starting init: /sbin/init exists but couldn't execute it (error -22)
Run /etc/init as init process
Run /bin/init as init process
jffs2: error: (1) jffs2_build_inode_fragtree: Add node to tree failed -22
jffs2: error: (1) jffs2_do_read_inode_internal: Failed to build final fragtree for inode #2: error -22
jffs2: iget() failed for ino #2
Starting init: /bin/init exists but couldn't execute it (error -22)
Run /bin/sh as init process
jffs2: error: (1) jffs2_build_inode_fragtree: Add node to tree failed -22
jffs2: error: (1) jffs2_do_read_inode_internal: Failed to build final fragtree for inode #2: error -22
jffs2: iget() failed for ino #2
Starting init: /bin/sh exists but couldn't execute it (error -22)
jffs2: error: (36) jffs2_do_read_inode_internal: Failed to build final fragtree for inode #128: error -22
Kernel panic - not syncing: No working init found.  Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.

Fixes: f2538f99934 ("jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()")
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
---
 fs/jffs2/nodelist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/jffs2/nodelist.c b/fs/jffs2/nodelist.c
index 021a4a2190ee..b86c78d178c6 100644
--- a/fs/jffs2/nodelist.c
+++ b/fs/jffs2/nodelist.c
@@ -226,7 +226,7 @@ static int jffs2_add_frag_to_fragtree(struct jffs2_sb_info *c, struct rb_root *r
 		lastend = this->ofs + this->size;
 	} else {
 		dbg_fragtree2("lookup gave no frag\n");
-		return -EINVAL;
+		lastend = 0;
 	}
 
 	/* See if we ran off the end of the fragtree */
-- 
2.23.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH] Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()"

[Richard Weinberger]

----- Ursprüngliche Mail -----
> Von: "Alexander Sverdlin" <alexander.sverdlin@gmail.com>
> An: "linux-mtd" <linux-mtd@lists.infradead.org>
> CC: "Alexander Sverdlin" <alexander.sverdlin@gmail.com>, "David Woodhouse" <dwmw2@infradead.org>, "richard"
> <richard@nod.at>, "Jia-Ju Bai" <baijiaju1990@gmail.com>
> Gesendet: Samstag, 19. Oktober 2019 17:55:56
> Betreff: [PATCH] Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()"
> This reverts commit f2538f999345405f7d2e1194c0c8efa4e11f7b3a.
> 
> Looks like NULL this is never dereferenced in reality because the function
> returns earlier with "return no_overlapping_node(...)".

Indeed. ;-\

Jia-Ju Bai, the issue your tool found seems to be a false positive, so I'll
take this revert.

Thanks,
//richard

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/