From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE1CDC4CECE for ; Wed, 18 Sep 2019 06:33:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C49EE218AE for ; Wed, 18 Sep 2019 06:33:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1568788384; bh=COj6+7yNvGeh2H5OUUJGPmHTRZ6z2tYtHadnmi6OB7M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=GU49DFBZApU1vAhQbFkXc4k6shghyOKTOdvGGFFOoTdqyox589+UYjEfYW+nP0X47 vGZC0nK3sNB/BCmQKLl9UcJGVIogePm8G316mNELC8y40qpJ9WavMKFkAoJB0sBH5h 3bnzvVF4YSwSucY08bBZDZJUHe9/rEfBJOs79jXk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728936AbfIRGVG (ORCPT ); Wed, 18 Sep 2019 02:21:06 -0400 Received: from mail.kernel.org ([198.145.29.99]:40300 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728930AbfIRGVF (ORCPT ); Wed, 18 Sep 2019 02:21:05 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 726D220678; Wed, 18 Sep 2019 06:21:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1568787664; bh=COj6+7yNvGeh2H5OUUJGPmHTRZ6z2tYtHadnmi6OB7M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j6OOoNQz7DXOJRpiWyWrnMgwvhYnAnPTJG5/3zJjqKfiHp2ZYMiVIbXN3JNf2n7XO RM6G/AKrFiQmAhiCGd0KBOCXz2Hbrt5iJAudHzunfNtTnDmWAo/ls7k7lIDmvGIQS2 glwtn6UsIS5G4ue8Jl1EtNFHQDEuieg5FbwraFKY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hyunchul Lee , Geert Uytterhoeven , Richard Weinberger Subject: [PATCH 4.14 32/45] ubifs: Correctly use tnc_next() in search_dh_cookie() Date: Wed, 18 Sep 2019 08:19:10 +0200 Message-Id: <20190918061226.735342219@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190918061222.854132812@linuxfoundation.org> References: <20190918061222.854132812@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Richard Weinberger commit bacfa94b08027b9f66ede7044972e3b066766b3e upstream. Commit c877154d307f fixed an uninitialized variable and optimized the function to not call tnc_next() in the first iteration of the loop. While this seemed perfectly legit and wise, it turned out to be illegal. If the lookup function does not find an exact match it will rewind the cursor by 1. The rewinded cursor will not match the name hash we are looking for and this results in a spurious -ENOENT. So we need to move to the next entry in case of an non-exact match, but not if the match was exact. While we are here, update the documentation to avoid further confusion. Cc: Hyunchul Lee Cc: Geert Uytterhoeven Fixes: c877154d307f ("ubifs: Fix uninitialized variable in search_dh_cookie()") Fixes: 781f675e2d7e ("ubifs: Fix unlink code wrt. double hash lookups") Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman --- fs/ubifs/tnc.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) --- a/fs/ubifs/tnc.c +++ b/fs/ubifs/tnc.c @@ -1164,8 +1164,8 @@ static struct ubifs_znode *dirty_cow_bot * o exact match, i.e. the found zero-level znode contains key @key, then %1 * is returned and slot number of the matched branch is stored in @n; * o not exact match, which means that zero-level znode does not contain - * @key, then %0 is returned and slot number of the closest branch is stored - * in @n; + * @key, then %0 is returned and slot number of the closest branch or %-1 + * is stored in @n; In this case calling tnc_next() is mandatory. * o @key is so small that it is even less than the lowest key of the * leftmost zero-level node, then %0 is returned and %0 is stored in @n. * @@ -1882,13 +1882,19 @@ int ubifs_tnc_lookup_nm(struct ubifs_inf static int search_dh_cookie(struct ubifs_info *c, const union ubifs_key *key, struct ubifs_dent_node *dent, uint32_t cookie, - struct ubifs_znode **zn, int *n) + struct ubifs_znode **zn, int *n, int exact) { int err; struct ubifs_znode *znode = *zn; struct ubifs_zbranch *zbr; union ubifs_key *dkey; + if (!exact) { + err = tnc_next(c, &znode, n); + if (err) + return err; + } + for (;;) { zbr = &znode->zbranch[*n]; dkey = &zbr->key; @@ -1930,7 +1936,7 @@ static int do_lookup_dh(struct ubifs_inf if (unlikely(err < 0)) goto out_unlock; - err = search_dh_cookie(c, key, dent, cookie, &znode, &n); + err = search_dh_cookie(c, key, dent, cookie, &znode, &n, err); out_unlock: mutex_unlock(&c->tnc_mutex); @@ -2716,7 +2722,7 @@ int ubifs_tnc_remove_dh(struct ubifs_inf if (unlikely(err < 0)) goto out_free; - err = search_dh_cookie(c, key, dent, cookie, &znode, &n); + err = search_dh_cookie(c, key, dent, cookie, &znode, &n, err); if (err) goto out_free; }