From nobody Sat Apr 18 21:04:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7727DC43334 for ; Mon, 11 Jul 2022 11:11:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229954AbiGKLL0 (ORCPT ); Mon, 11 Jul 2022 07:11:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50308 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229853AbiGKLLC (ORCPT ); Mon, 11 Jul 2022 07:11:02 -0400 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 278A855B0 for ; Mon, 11 Jul 2022 03:18:10 -0700 (PDT) Received: from dggpemm500022.china.huawei.com (unknown [172.30.72.54]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4LhKXb0NPNzkX2s; Mon, 11 Jul 2022 18:15:59 +0800 (CST) Received: from dggpemm100009.china.huawei.com (7.185.36.113) by dggpemm500022.china.huawei.com (7.185.36.162) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Mon, 11 Jul 2022 18:18:08 +0800 Received: from huawei.com (10.175.101.6) by dggpemm100009.china.huawei.com (7.185.36.113) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Mon, 11 Jul 2022 18:18:07 +0800 From: ZhaoLong Wang To: CC: , , , , , Subject: [PATCH V2] ubifs: Fix the issue that UBIFS be read-only due to truncate in the encrypted directory. Date: Mon, 11 Jul 2022 18:26:39 +0800 Message-ID: <20220711102639.1331660-1-wangzhaolong1@huawei.com> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.101.6] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To dggpemm100009.china.huawei.com (7.185.36.113) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" The ubifs_compress() function does not compress the data When the data length is short than 128 bytes or the compressed data length is not ideal.It cause that the compressed length of the truncated data in the truncate_data_node() function may be greater than the length of the raw data read from the flash. The above two lengths are transferred to the ubifs_encrypt() function as parameters. This may lead to assertion fails and then the file system becomes read-only. This patch use the actual length of the data in the memory as the input parameter for assert comparison, which avoids the problem. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D216213 Signed-off-by: ZhaoLong Wang --- V1->V2 Change: 1. An extra space is deleted. 2. The code text aligns like the previous code 3. dn_size variable in ubifs_jnl_truncate() declare on previous line. fs/ubifs/crypto.c | 11 +++++++++++ fs/ubifs/journal.c | 28 +++++++++++++++++----------- 2 files changed, 28 insertions(+), 11 deletions(-) diff --git a/fs/ubifs/crypto.c b/fs/ubifs/crypto.c index c57b46a352d8..3125e76376ee 100644 --- a/fs/ubifs/crypto.c +++ b/fs/ubifs/crypto.c @@ -24,6 +24,17 @@ static bool ubifs_crypt_empty_dir(struct inode *inode) return ubifs_check_dir_empty(inode) =3D=3D 0; } =20 +/** + * ubifs_encrypt - Encrypt data. + * @inode: inode which refers to the data node + * @dn: data node to encrypt + * @in_len: length of data to be compressed + * @out_len: allocated memory size for the data area of @dn + * @block: logical block number of the block + * + * This function encrypt a possibly-compressed data in the data node. + * The encrypted data length will store in @out_len. + */ int ubifs_encrypt(const struct inode *inode, struct ubifs_data_node *dn, unsigned int in_len, unsigned int *out_len, int block) { diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c index 75dab0ae3939..2b1d7c4297bf 100644 --- a/fs/ubifs/journal.c +++ b/fs/ubifs/journal.c @@ -1472,23 +1472,25 @@ int ubifs_jnl_rename(struct ubifs_info *c, const st= ruct inode *old_dir, * @block: data block number * @dn: data node to re-compress * @new_len: new length + * @dn_size: size of the data node @dn in memory * * This function is used when an inode is truncated and the last data node= of * the inode has to be re-compressed/encrypted and re-written. */ static int truncate_data_node(const struct ubifs_info *c, const struct ino= de *inode, unsigned int block, struct ubifs_data_node *dn, - int *new_len) + int *new_len, int dn_size) { void *buf; - int err, dlen, compr_type, out_len, old_dlen; + int err, dlen, compr_type, out_len, data_size; =20 out_len =3D le32_to_cpu(dn->size); buf =3D kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS); if (!buf) return -ENOMEM; =20 - dlen =3D old_dlen =3D le32_to_cpu(dn->ch.len) - UBIFS_DATA_NODE_SZ; + dlen =3D le32_to_cpu(dn->ch.len) - UBIFS_DATA_NODE_SZ; + data_size =3D dn_size - UBIFS_DATA_NODE_SZ; compr_type =3D le16_to_cpu(dn->compr_type); =20 if (IS_ENCRYPTED(inode)) { @@ -1508,11 +1510,11 @@ static int truncate_data_node(const struct ubifs_in= fo *c, const struct inode *in } =20 if (IS_ENCRYPTED(inode)) { - err =3D ubifs_encrypt(inode, dn, out_len, &old_dlen, block); + err =3D ubifs_encrypt(inode, dn, out_len, &data_size, block); if (err) goto out; =20 - out_len =3D old_dlen; + out_len =3D data_size; } else { dn->compr_size =3D 0; } @@ -1550,6 +1552,6 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const st= ruct inode *inode, struct ubifs_trun_node *trun; struct ubifs_data_node *dn; - int err, dlen, len, lnum, offs, bit, sz, sync =3D IS_SYNC(inode); + int err, dlen, len, lnum, offs, bit, sz, dn_size, sync =3D IS_SYNC(inode); struct ubifs_inode *ui =3D ubifs_inode(inode); ino_t inum =3D inode->i_ino; unsigned int blk; @@ -1562,10 +1565,13 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const = struct inode *inode, ubifs_assert(c, S_ISREG(inode->i_mode)); ubifs_assert(c, mutex_is_locked(&ui->ui_mutex)); =20 - sz =3D UBIFS_TRUN_NODE_SZ + UBIFS_INO_NODE_SZ + - UBIFS_MAX_DATA_NODE_SZ * WORST_COMPR_FACTOR; + dn_size =3D COMPRESSED_DATA_NODE_BUF_SZ; =20 - sz +=3D ubifs_auth_node_sz(c); + if (IS_ENCRYPTED(inode)) + dn_size +=3D UBIFS_CIPHER_BLOCK_SIZE; + + sz =3D UBIFS_TRUN_NODE_SZ + UBIFS_INO_NODE_SZ + + dn_size + ubifs_auth_node_sz(c); =20 ino =3D kmalloc(sz, GFP_NOFS); if (!ino) @@ -1596,15 +1602,15 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const = struct inode *inode, if (dn_len <=3D 0 || dn_len > UBIFS_BLOCK_SIZE) { ubifs_err(c, "bad data node (block %u, inode %lu)", blk, inode->i_ino); - ubifs_dump_node(c, dn, sz - UBIFS_INO_NODE_SZ - - UBIFS_TRUN_NODE_SZ); + ubifs_dump_node(c, dn, dn_size); goto out_free; } =20 if (dn_len <=3D dlen) dlen =3D 0; /* Nothing to do */ else { - err =3D truncate_data_node(c, inode, blk, dn, &dlen); + err =3D truncate_data_node(c, inode, blk, dn, + &dlen, dn_size); if (err) goto out_free; } --=20 2.31.1