From patchwork Sat Sep 23 03:28:59 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhihao Cheng X-Patchwork-Id: 143802 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:910f:0:b0:403:3b70:6f57 with SMTP id r15csp65104vqg; Fri, 22 Sep 2023 20:46:03 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEFKng2qQSc6bfY0c7j1isvRjl4TEz7CQHMZSUy33jQRYRXCxS4BNM2qiHn3RKqesNGH2pF X-Received: by 2002:a05:6808:190b:b0:3ae:10c7:1fbe with SMTP id bf11-20020a056808190b00b003ae10c71fbemr1879973oib.30.1695440762836; Fri, 22 Sep 2023 20:46:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1695440762; cv=none; d=google.com; s=arc-20160816; b=A93DYJ09qP4iMBd8tQkNlLxsdAby5OsQ9U4NusGBcSgfbhujhILvsaz5HMWKbU05mh N5hgJ/6Kg1NSCgAMAmlSGiY4T+SDc+4ycue0QDG/791Jxql2kn4Uwhr77ygHiT3qg/Je yM0jsEP5ckxH2v08/GrtKefr2pIXaaR3lNlAjpl8URVCHoUdAxMWUsa+9Q8v2PfHWHTa alP6xIBSIF7oLAfDIw7jojxvjAeDjUrfYC13+IJDAOMzHLgbpsYSPPeltH94cDl6Dtp2 UQRrlsxb/ZvNW54KkJBlV39as9HtBHsng3/2S+V74rM4D9Jj2TfS7U8AoijHoRbri7MI LwOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=o25QFnwd9NP6oBezXGxXiJe8UufCmhTP1dkIv8NMKIA=; fh=D4lTBkwdkCt7r6bJfvK6wNNHa5nhIDBgshA0bynFuRI=; b=t9DV2yIz/us+7UD1IUTrlbXkNr3RPcOINJaHGW8o9TKGD5RXrK3X159EpqhZwb8uZj lSk3mS8KH7egWmX8PqTSq5ziUnrHa16Q8eqScuDblPTp0tr4Ll5z8J4DQGFERVvKSUGr rsAr3jTIGYvcOwIFq8DfP3NZjkZy6OI1DzZ5PhiikwgMnoTd164RBJ7yOEa7C9pRZ2a/ 7XFtePLdlMevR45dOS/ULGU71L5VpjqqGKojcmrghG3nPogiMmy7+XXEaW/Z/yUlzUm0 /3/NzmZI4fvYhJMZat6/vIYNKVFHdHFYmRhbWKBFfAWcxeCXtxJ4chdKbDLFWiHqW3oC nwGA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from groat.vger.email (groat.vger.email. [2620:137:e000::3:5]) by mx.google.com with ESMTPS id eb27-20020a056a004c9b00b00691019fd0efsi5236346pfb.75.2023.09.22.20.46.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 22 Sep 2023 20:46:02 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) client-ip=2620:137:e000::3:5; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by groat.vger.email (Postfix) with ESMTP id 11DDB8389DB9; Fri, 22 Sep 2023 20:45:29 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at groat.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230013AbjIWDfI (ORCPT + 28 others); Fri, 22 Sep 2023 23:35:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44046 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229592AbjIWDfH (ORCPT ); Fri, 22 Sep 2023 23:35:07 -0400 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D1A42A9 for ; Fri, 22 Sep 2023 20:34:59 -0700 (PDT) Received: from kwepemm000013.china.huawei.com (unknown [172.30.72.53]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4RsvmH6jzlztSZt; Sat, 23 Sep 2023 11:30:39 +0800 (CST) Received: from huawei.com (10.175.104.67) by kwepemm000013.china.huawei.com (7.193.23.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Sat, 23 Sep 2023 11:34:56 +0800 From: Zhihao Cheng To: , , CC: , , Subject: [PATCH] ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted Date: Sat, 23 Sep 2023 11:28:59 +0800 Message-ID: <20230923032859.3857274-1-chengzhihao1@huawei.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 X-Originating-IP: [10.175.104.67] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To kwepemm000013.china.huawei.com (7.193.23.81) X-CFilter-Loop: Reflected X-Spam-Status: No, score=2.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_SBL_CSS,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Fri, 22 Sep 2023 20:45:29 -0700 (PDT) X-Spam-Level: ** X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1777798493147351770 X-GMAIL-MSGID: 1777798493147351770 The length of dentry name is calculated after the raw name is encrypted, except for ubifs_link(), which could make the size of dir underflow. Here is a reproducer: touch $TMP/file mkdir $TMP/dir stat $TMP/dir for i in $(seq 1 8) do ln $TMP/file $TMP/dir/$i unlink $TMP/dir/$i done stat $TMP/dir The size of dir will be underflow(-96). Fix it by calculating dentry name's length after the name is encrypted. Fixes: f4f61d2cc6d8 ("ubifs: Implement encrypted filenames") Reported-by: Roland Ruckerbauer Link: https://lore.kernel.org/linux-mtd/1638777819.2925845.1695222544742.JavaMail.zimbra@robart.cc/T/#u Signed-off-by: Zhihao Cheng --- fs/ubifs/dir.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c index 2f48c58d47cd..5dc1ac4d826d 100644 --- a/fs/ubifs/dir.c +++ b/fs/ubifs/dir.c @@ -724,7 +724,7 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir, struct inode *inode = d_inode(old_dentry); struct ubifs_inode *ui = ubifs_inode(inode); struct ubifs_inode *dir_ui = ubifs_inode(dir); - int err, sz_change = CALC_DENT_SIZE(dentry->d_name.len); + int err, sz_change; struct ubifs_budget_req req = { .new_dent = 1, .dirtied_ino = 2, .dirtied_ino_d = ALIGN(ui->data_len, 8) }; struct fscrypt_name nm; @@ -748,6 +748,8 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir, if (err) return err; + sz_change = CALC_DENT_SIZE(fname_len(&nm)); + err = dbg_check_synced_i_size(c, inode); if (err) goto out_fname;