Re: [PATCH v2] ubifs: Fix read out-of-bounds in ubifs_jnl_write_inode()

From: Zhihao Cheng
Date: Wed Dec 23 2020 - 20:15:16 EST

在 2020/12/24 7:07, Richard Weinberger 写道:

0. config KASAN && apply print.patch
1. mount ubifs on /root/temp
2. run

What does do?
Go to Link: creates a very long path file test_file, and then create a symbol link link_file for test_file, so ubifs inode for link_file will be assigned a big value for ui->data_len.
When we change atime for link_file, ubifs_jnl_write_inode will be executed by wb_writeback. By this way, write_len could be not aligned with 8 bytes.

3. cd /root/temp && ls // change atime for link_file
4. wait 1~2 minutes

In order to solve the read oob problem in ubifs_wbuf_write_nolock, just align
the write_len to
8 bytes when alloc the memory. So that this patch will not affect the use of
write_len in other
functions, such as ubifs_jnl_write_inode->make_reservation and

I gave this a second thought and I'm not so sure anymore what exactly is going on.
The problem is real, I fully agree with you but I need to dig deeper into
the journal and wbuf code to double check that we really fix the right thing
and not just paper other something.