ubifs: Check data node size before truncate
authorRichard Weinberger <richard@nod.at>
Sun, 1 Jul 2018 21:20:51 +0000 (23:20 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 9 Sep 2018 17:56:00 +0000 (19:56 +0200)
commitf6d7acc1d9cae277b0379e8209eaefe59a3fbf79
tree07dca588f9469737b5bec4722a855e0b42a96e31
parent3259dd7176e4d98248f2dcc94f540dbca051ff42
ubifs: Check data node size before truncate

commit 95a22d2084d72ea067d8323cc85677dba5d97cae upstream.

Check whether the size is within bounds before using it.
If the size is not correct, abort and dump the bad data node.

Cc: Kees Cook <keescook@chromium.org>
Cc: Silvio Cesare <silvio.cesare@gmail.com>
Cc: stable@vger.kernel.org
Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system")
Reported-by: Silvio Cesare <silvio.cesare@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/ubifs/journal.c