From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Ajesh Kunhipurayil Vijayan <ajesh@broadcom.com>,
Kamlakant Patel <kamlakant.patel@broadcom.com>,
Brian Norris <computersforpeace@gmail.com>
Subject: [PATCH 3.13 25/32] jffs2: Fix crash due to truncation of csize
Date: Sun, 20 Apr 2014 19:13:42 -0700 [thread overview]
Message-ID: <20140421021137.296606614@linuxfoundation.org> (raw)
In-Reply-To: <20140421021133.865086647@linuxfoundation.org>
3.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ajesh Kunhipurayil Vijayan <ajesh@broadcom.com>
commit 41bf1a24c1001f4d0d41a78e1ac575d2f14789d7 upstream.
mounting JFFS2 partition sometimes crashes with this call trace:
[ 1322.240000] Kernel bug detected[#1]:
[ 1322.244000] Cpu 2
[ 1322.244000] $ 0 : 0000000000000000 0000000000000018 000000003ff00070 0000000000000001
[ 1322.252000] $ 4 : 0000000000000000 c0000000f3980150 0000000000000000 0000000000010000
[ 1322.260000] $ 8 : ffffffffc09cd5f8 0000000000000001 0000000000000088 c0000000ed300de8
[ 1322.268000] $12 : e5e19d9c5f613a45 ffffffffc046d464 0000000000000000 66227ba5ea67b74e
[ 1322.276000] $16 : c0000000f1769c00 c0000000ed1e0200 c0000000f3980150 0000000000000000
[ 1322.284000] $20 : c0000000f3a80000 00000000fffffffc c0000000ed2cfbd8 c0000000f39818f0
[ 1322.292000] $24 : 0000000000000004 0000000000000000
[ 1322.300000] $28 : c0000000ed2c0000 c0000000ed2cfab8 0000000000010000 ffffffffc039c0b0
[ 1322.308000] Hi : 000000000000023c
[ 1322.312000] Lo : 000000000003f802
[ 1322.316000] epc : ffffffffc039a9f8 check_tn_node+0x88/0x3b0
[ 1322.320000] Not tainted
[ 1322.324000] ra : ffffffffc039c0b0 jffs2_do_read_inode_internal+0x1250/0x1e48
[ 1322.332000] Status: 5400f8e3 KX SX UX KERNEL EXL IE
[ 1322.336000] Cause : 00800034
[ 1322.340000] PrId : 000c1004 (Netlogic XLP)
[ 1322.344000] Modules linked in:
[ 1322.348000] Process jffs2_gcd_mtd7 (pid: 264, threadinfo=c0000000ed2c0000, task=c0000000f0e68dd8, tls=0000000000000000)
[ 1322.356000] Stack : c0000000f1769e30 c0000000ed010780 c0000000ed010780 c0000000ed300000
c0000000f1769c00 c0000000f3980150 c0000000f3a80000 00000000fffffffc
c0000000ed2cfbd8 ffffffffc039c0b0 ffffffffc09c6340 0000000000001000
0000000000000dec ffffffffc016c9d8 c0000000f39805a0 c0000000f3980180
0000008600000000 0000000000000000 0000000000000000 0000000000000000
0001000000000dec c0000000f1769d98 c0000000ed2cfb18 0000000000010000
0000000000010000 0000000000000044 c0000000f3a80000 c0000000f1769c00
c0000000f3d207a8 c0000000f1769d98 c0000000f1769de0 ffffffffc076f9c0
0000000000000009 0000000000000000 0000000000000000 ffffffffc039cf90
0000000000000017 ffffffffc013fbdc 0000000000000001 000000010003e61c
...
[ 1322.424000] Call Trace:
[ 1322.428000] [<ffffffffc039a9f8>] check_tn_node+0x88/0x3b0
[ 1322.432000] [<ffffffffc039c0b0>] jffs2_do_read_inode_internal+0x1250/0x1e48
[ 1322.440000] [<ffffffffc039cf90>] jffs2_do_crccheck_inode+0x70/0xd0
[ 1322.448000] [<ffffffffc03a1b80>] jffs2_garbage_collect_pass+0x160/0x870
[ 1322.452000] [<ffffffffc03a392c>] jffs2_garbage_collect_thread+0xdc/0x1f0
[ 1322.460000] [<ffffffffc01541c8>] kthread+0xb8/0xc0
[ 1322.464000] [<ffffffffc0106d18>] kernel_thread_helper+0x10/0x18
[ 1322.472000]
[ 1322.472000]
Code: 67bd0050 94a4002c 2c830001 <00038036> de050218 2403fffc 0080a82d 00431824 24630044
[ 1322.480000] ---[ end trace b052bb90e97dfbf5 ]---
The variable csize in structure jffs2_tmp_dnode_info is of type uint16_t, but it
is used to hold the compressed data length(csize) which is declared as uint32_t.
So, when the value of csize exceeds 16bits, it gets truncated when assigned to
tn->csize. This is causing a kernel BUG.
Changing the definition of csize in jffs2_tmp_dnode_info to uint32_t fixes the issue.
Signed-off-by: Ajesh Kunhipurayil Vijayan <ajesh@broadcom.com>
Signed-off-by: Kamlakant Patel <kamlakant.patel@broadcom.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jffs2/nodelist.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/jffs2/nodelist.h
+++ b/fs/jffs2/nodelist.h
@@ -231,7 +231,7 @@ struct jffs2_tmp_dnode_info
uint32_t version;
uint32_t data_crc;
uint32_t partial_crc;
- uint16_t csize;
+ uint32_t csize;
uint16_t overlapped;
};
next prev parent reply other threads:[~2014-04-21 2:13 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-21 2:13 [PATCH 3.13 00/32] 3.13.11-stable review Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 01/32] user namespace: fix incorrect memory barriers Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 02/32] Char: ipmi_bt_sm, fix infinite loop Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 03/32] x86, hyperv: Bypass the timer_irq_works() check Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 04/32] x86: Adjust irq remapping quirk for older revisions of 5500/5520 chipsets Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 05/32] PCI: designware: Fix RC BAR to be single 64-bit non-prefetchable memory BAR Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 06/32] PCI: designware: Fix iATU programming for cfg1, io and mem viewport Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 07/32] ACPI / button: Add ACPI Button event via netlink routine Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 08/32] PCI: Enable INTx in pci_reenable_device() only when MSI/MSI-X not enabled Greg Kroah-Hartman
2014-04-21 14:24 ` Ben Hutchings
2014-04-22 16:32 ` Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 09/32] staging: comedi: 8255_pci: initialize MITE data window Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 10/32] tty: Set correct tty name in active sysfs attribute Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 11/32] tty: Fix low_latency BUG Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 12/32] SCSI: sd: dont fail if the device doesnt recognize SYNCHRONIZE CACHE Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 14/32] Bluetooth: Fix removing Long Term Key Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 15/32] ima: restore the original behavior for sending data with ima template Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 16/32] backing_dev: fix hung task on sync Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 17/32] bdi: avoid oops on device removal Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 18/32] xfs: fix directory hash ordering bug Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 19/32] Btrfs: skip submitting barrier for missing device Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 20/32] Btrfs: fix deadlock with nested trans handles Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 21/32] ext4: fix error return from ext4_ext_handle_uninitialized_extents() Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 22/32] ext4: fix partial cluster handling for bigalloc file systems Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 23/32] ext4: fix premature freeing of partial clusters split across leaf blocks Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 24/32] jffs2: Fix segmentation fault found in stress test Greg Kroah-Hartman
2014-04-21 2:13 ` Greg Kroah-Hartman [this message]
2014-04-21 2:13 ` [PATCH 3.13 26/32] jffs2: avoid soft-lockup in jffs2_reserve_space_gc() Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 27/32] jffs2: remove from wait queue after schedule() Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 28/32] sparc32: fix build failure for arch_jump_label_transform Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 29/32] sparc64: dont treat 64-bit syscall return codes as 32-bit Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 30/32] sparc64: Make sure %pil interrupts are enabled during hypervisor yield Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 31/32] wait: fix reparent_leader() vs EXIT_DEAD->EXIT_ZOMBIE race Greg Kroah-Hartman
2014-04-21 2:13 ` [PATCH 3.13 32/32] exit: call disassociate_ctty() before exit_task_namespaces() Greg Kroah-Hartman
2014-04-21 13:25 ` [PATCH 3.13 00/32] 3.13.11-stable review Guenter Roeck
2014-04-21 19:03 ` Greg Kroah-Hartman
2014-04-22 1:06 ` Guenter Roeck
2014-04-22 1:14 ` Greg Kroah-Hartman
2014-04-22 15:48 ` Shuah Khan
2014-04-22 19:36 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140421021137.296606614@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ajesh@broadcom.com \
--cc=computersforpeace@gmail.com \
--cc=kamlakant.patel@broadcom.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).