ubifs: Check data node size before truncate
authorRichard Weinberger <richard@nod.at>
Sun, 1 Jul 2018 21:20:51 +0000 (23:20 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 9 Sep 2018 18:01:24 +0000 (20:01 +0200)
commit1bc1f0f72992c97d99bb50b231592750199db02a
treecfac68fd0be782472606ecc564986e6d12a9db2a
parent48e1148488b6d88e3d0b803867db249bc5568d42
ubifs: Check data node size before truncate

commit 95a22d2084d72ea067d8323cc85677dba5d97cae upstream.

Check whether the size is within bounds before using it.
If the size is not correct, abort and dump the bad data node.

Cc: Kees Cook <keescook@chromium.org>
Cc: Silvio Cesare <silvio.cesare@gmail.com>
Cc: stable@vger.kernel.org
Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system")
Reported-by: Silvio Cesare <silvio.cesare@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/ubifs/journal.c