Revert "ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len"

This reverts commit acc5af3efa30 ("ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len")

No need to avoid memory oob in dumping for data node alone. Later, node
length will be passed into function 'ubifs_dump_node()' which replaces
all node dumping places.

Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>

diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index a9cabb3..be50cb5 100644 (file)
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -225,7 +225,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum)
 int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
                     int offs, int quiet, int must_chk_crc)
 {
-       int err = -EINVAL, type, node_len, dump_node = 1;
+       int err = -EINVAL, type, node_len;
        uint32_t crc, node_crc, magic;
        const struct ubifs_ch *ch = buf;
 
@@ -278,22 +278,10 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
 out_len:
        if (!quiet)
                ubifs_err(c, "bad node length %d", node_len);
-       if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ)
-               dump_node = 0;
 out:
        if (!quiet) {
                ubifs_err(c, "bad node at LEB %d:%d", lnum, offs);
-               if (dump_node) {
-                       ubifs_dump_node(c, buf);
-               } else {
-                       int safe_len = min3(node_len, c->leb_size - offs,
-                               (int)UBIFS_MAX_DATA_NODE_SZ);
-                       pr_err("\tprevent out-of-bounds memory access\n");
-                       pr_err("\ttruncated data node length      %d\n", safe_len);
-                       pr_err("\tcorrupted data node:\n");
-                       print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1,
-                                       buf, safe_len, 0);
-               }
+               ubifs_dump_node(c, buf);
                dump_stack();
        }
        return err;