Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1343995d authored by Richard Weinberger's avatar Richard Weinberger Committed by Greg Kroah-Hartman
Browse files

ubifs: wbuf: Don't leak kernel memory to flash 



commit 20f1431160c6b590cdc269a846fc5a448abf5b98 upstream.

Write buffers use a kmalloc()'ed buffer, they can leak
up to seven bytes of kernel memory to flash if writes are not
aligned.
So use ubifs_pad() to fill these gaps with padding bytes.
This was never a problem while scanning because the scanner logic
manually aligns node lengths and skips over these gaps.

Cc: <stable@vger.kernel.org>
Fixes: 1e51764a ("UBIFS: add new flash file system")
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
Reviewed-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9ee56388

fs/ubifs/io.c

+11 −2
Original line number Diff line number Diff line
@@ -331,7 +331,7 @@ void ubifs_pad(const struct ubifs_info *c, void *buf, int pad) 
{

	uint32_t crc;



	ubifs_assert(c, pad >= 0 && !(pad & 7));

	ubifs_assert(c, pad >= 0);



	if (pad >= UBIFS_PAD_NODE_SZ) {

		struct ubifs_ch *ch = buf;
@@ -728,6 +728,10 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len) 
		 * write-buffer.

		 */

		memcpy(wbuf->buf + wbuf->used, buf, len);

		if (aligned_len > len) {

			ubifs_assert(c, aligned_len - len < 8);

			ubifs_pad(c, wbuf->buf + wbuf->used + len, aligned_len - len);

		}



		if (aligned_len == wbuf->avail) {

			dbg_io("flush jhead %s wbuf to LEB %d:%d",
@@ -820,13 +824,18 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len) 
	}



	spin_lock(&wbuf->lock);

	if (aligned_len)

	if (aligned_len) {

		/*

		 * And now we have what's left and what does not take whole

		 * max. write unit, so write it to the write-buffer and we are

		 * done.

		 */

		memcpy(wbuf->buf, buf + written, len);

		if (aligned_len > len) {

			ubifs_assert(c, aligned_len - len < 8);

			ubifs_pad(c, wbuf->buf + len, aligned_len - len);

		}

	}



	if (c->leb_size - wbuf->offs >= c->max_write_size)

		wbuf->size = c->max_write_size;