From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Jayachandran C <jchandra@broadcom.com>,
Kamlakant Patel <kamlakant.patel@broadcom.com>,
Brian Norris <computersforpeace@gmail.com>
Subject: [PATCH 3.14 28/33] jffs2: Fix segmentation fault found in stress test
Date: Thu, 24 Apr 2014 14:48:41 -0700 [thread overview]
Message-ID: <20140424214453.713801030@linuxfoundation.org> (raw)
In-Reply-To: <20140424214449.423169713@linuxfoundation.org>
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamlakant Patel <kamlakant.patel@broadcom.com>
commit 3367da5610c50e6b83f86d366d72b41b350b06a2 upstream.
Creating a large file on a JFFS2 partition sometimes crashes with this call
trace:
[ 306.476000] CPU 13 Unable to handle kernel paging request at virtual address c0000000dfff8002, epc == ffffffffc03a80a8, ra == ffffffffc03a8044
[ 306.488000] Oops[#1]:
[ 306.488000] Cpu 13
[ 306.492000] $ 0 : 0000000000000000 0000000000000000 0000000000008008 0000000000008007
[ 306.500000] $ 4 : c0000000dfff8002 000000000000009f c0000000e0007cde c0000000ee95fa58
[ 306.508000] $ 8 : 0000000000000001 0000000000008008 0000000000010000 ffffffffffff8002
[ 306.516000] $12 : 0000000000007fa9 000000000000ff0e 000000000000ff0f 80e55930aebb92bb
[ 306.524000] $16 : c0000000e0000000 c0000000ee95fa5c c0000000efc80000 ffffffffc09edd70
[ 306.532000] $20 : ffffffffc2b60000 c0000000ee95fa58 0000000000000000 c0000000efc80000
[ 306.540000] $24 : 0000000000000000 0000000000000004
[ 306.548000] $28 : c0000000ee950000 c0000000ee95f738 0000000000000000 ffffffffc03a8044
[ 306.556000] Hi : 00000000000574a5
[ 306.560000] Lo : 6193b7a7e903d8c9
[ 306.564000] epc : ffffffffc03a80a8 jffs2_rtime_compress+0x98/0x198
[ 306.568000] Tainted: G W
[ 306.572000] ra : ffffffffc03a8044 jffs2_rtime_compress+0x34/0x198
[ 306.580000] Status: 5000f8e3 KX SX UX KERNEL EXL IE
[ 306.584000] Cause : 00800008
[ 306.588000] BadVA : c0000000dfff8002
[ 306.592000] PrId : 000c1100 (Netlogic XLP)
[ 306.596000] Modules linked in:
[ 306.596000] Process dd (pid: 170, threadinfo=c0000000ee950000, task=c0000000ee6e0858, tls=0000000000c47490)
[ 306.608000] Stack : 7c547f377ddc7ee4 7ffc7f967f5d7fae 7f617f507fc37ff4 7e7d7f817f487f5f
7d8e7fec7ee87eb3 7e977ff27eec7f9e 7d677ec67f917f67 7f3d7e457f017ed7
7fd37f517f867eb2 7fed7fd17ca57e1d 7e5f7fe87f257f77 7fd77f0d7ede7fdb
7fba7fef7e197f99 7fde7fe07ee37eb5 7f5c7f8c7fc67f65 7f457fb87f847e93
7f737f3e7d137cd9 7f8e7e9c7fc47d25 7dbb7fac7fb67e52 7ff17f627da97f64
7f6b7df77ffa7ec5 80057ef17f357fb3 7f767fa27dfc7fd5 7fe37e8e7fd07e53
7e227fcf7efb7fa1 7f547e787fa87fcc 7fcb7fc57f5a7ffb 7fc07f6c7ea97e80
7e2d7ed17e587ee0 7fb17f9d7feb7f31 7f607e797e887faa 7f757fdd7c607ff3
7e877e657ef37fbd 7ec17fd67fe67ff7 7ff67f797ff87dc4 7eef7f3a7c337fa6
7fe57fc97ed87f4b 7ebe7f097f0b8003 7fe97e2a7d997cba 7f587f987f3c7fa9
...
[ 306.676000] Call Trace:
[ 306.680000] [<ffffffffc03a80a8>] jffs2_rtime_compress+0x98/0x198
[ 306.684000] [<ffffffffc0394f10>] jffs2_selected_compress+0x110/0x230
[ 306.692000] [<ffffffffc039508c>] jffs2_compress+0x5c/0x388
[ 306.696000] [<ffffffffc039dc58>] jffs2_write_inode_range+0xd8/0x388
[ 306.704000] [<ffffffffc03971bc>] jffs2_write_end+0x16c/0x2d0
[ 306.708000] [<ffffffffc01d3d90>] generic_file_buffered_write+0xf8/0x2b8
[ 306.716000] [<ffffffffc01d4e7c>] __generic_file_aio_write+0x1ac/0x350
[ 306.720000] [<ffffffffc01d50a0>] generic_file_aio_write+0x80/0x168
[ 306.728000] [<ffffffffc021f7dc>] do_sync_write+0x94/0xf8
[ 306.732000] [<ffffffffc021ff6c>] vfs_write+0xa4/0x1a0
[ 306.736000] [<ffffffffc02202e8>] SyS_write+0x50/0x90
[ 306.744000] [<ffffffffc0116cc0>] handle_sys+0x180/0x1a0
[ 306.748000]
[ 306.748000]
Code: 020b202d 0205282d 90a50000 <90840000> 14a40038 00000000 0060602d 0000282d 016c5823
[ 306.760000] ---[ end trace 79dd088435be02d0 ]---
Segmentation fault
This crash is caused because the 'positions' is declared as an array of signed
short. The value of position is in the range 0..65535, and will be converted
to a negative number when the position is greater than 32767 and causes a
corruption and crash. Changing the definition to 'unsigned short' fixes this
issue
Signed-off-by: Jayachandran C <jchandra@broadcom.com>
Signed-off-by: Kamlakant Patel <kamlakant.patel@broadcom.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/jffs2/compr_rtime.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/jffs2/compr_rtime.c
+++ b/fs/jffs2/compr_rtime.c
@@ -33,7 +33,7 @@ static int jffs2_rtime_compress(unsigned
unsigned char *cpage_out,
uint32_t *sourcelen, uint32_t *dstlen)
{
- short positions[256];
+ unsigned short positions[256];
int outpos = 0;
int pos=0;
@@ -74,7 +74,7 @@ static int jffs2_rtime_decompress(unsign
unsigned char *cpage_out,
uint32_t srclen, uint32_t destlen)
{
- short positions[256];
+ unsigned short positions[256];
int outpos = 0;
int pos=0;
next prev parent reply other threads:[~2014-04-24 21:48 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-24 21:48 [PATCH 3.14 00/33] 3.14.2-stable review Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 01/33] user namespace: fix incorrect memory barriers Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 02/33] Char: ipmi_bt_sm, fix infinite loop Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 03/33] x86, hyperv: Bypass the timer_irq_works() check Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 04/33] x86: Adjust irq remapping quirk for older revisions of 5500/5520 chipsets Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 05/33] PCI: designware: Fix RC BAR to be single 64-bit non-prefetchable memory BAR Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 06/33] PCI: designware: Fix iATU programming for cfg1, io and mem viewport Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 07/33] ACPI / button: Add ACPI Button event via netlink routine Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 08/33] staging: comedi: 8255_pci: initialize MITE data window Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 09/33] staging: comedi: fix circular locking dependency in comedi_mmap() Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 10/33] kernfs: fix off by one error Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 11/33] kernfs: protect lazy kernfs_iattrs allocation with mutex Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 12/33] tty: Set correct tty name in active sysfs attribute Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 13/33] tty: Fix low_latency BUG Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 14/33] SCSI: sd: dont fail if the device doesnt recognize SYNCHRONIZE CACHE Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 16/33] Bluetooth: Fix removing Long Term Key Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 17/33] ima: restore the original behavior for sending data with ima template Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 18/33] backing_dev: fix hung task on sync Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 19/33] bdi: avoid oops on device removal Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 20/33] xfs: fix directory hash ordering bug Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 21/33] Btrfs: skip submitting barrier for missing device Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 22/33] Btrfs: fix deadlock with nested trans handles Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 23/33] Btrfs: check for an extent_op on the locked ref Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 24/33] ext4: fix error return from ext4_ext_handle_uninitialized_extents() Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 25/33] ext4: fix partial cluster handling for bigalloc file systems Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 26/33] ext4: fix premature freeing of partial clusters split across leaf blocks Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 27/33] fs: NULL dereference in posix_acl_to_xattr() Greg Kroah-Hartman
2014-04-24 21:48 ` Greg Kroah-Hartman [this message]
2014-04-24 21:48 ` [PATCH 3.14 29/33] jffs2: Fix crash due to truncation of csize Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 30/33] jffs2: avoid soft-lockup in jffs2_reserve_space_gc() Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 31/33] jffs2: remove from wait queue after schedule() Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 32/33] wait: fix reparent_leader() vs EXIT_DEAD->EXIT_ZOMBIE race Greg Kroah-Hartman
2014-04-24 21:48 ` [PATCH 3.14 33/33] exit: call disassociate_ctty() before exit_task_namespaces() Greg Kroah-Hartman
2014-04-25 0:21 ` [PATCH 3.14 00/33] 3.14.2-stable review Guenter Roeck
2014-04-25 1:49 ` Greg Kroah-Hartman
2014-04-25 17:02 ` Shuah Khan
2014-04-25 17:29 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140424214453.713801030@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=computersforpeace@gmail.com \
--cc=jchandra@broadcom.com \
--cc=kamlakant.patel@broadcom.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).