Chengsong Ke,
- Ursprüngliche Mail -
> The memory area allocated in ubifs_jnl_write_inode() is not aligned with 8
> bytes:
> ino_start = ino = kmalloc(write_len, GFP_NOFS);
>
> When ino_start passed into write_head -> ubifs_wbuf_write_nolock:
>n = aligned_len >> c->max_write_shift;
>
在 2020/12/23 14:28, Chengsong Ke 写道:
Reviewed-by: Zhihao Cheng
From: kechengsong
ubifs_jnl_write_inode() probably cause read out-of-bounds in some situation.
There is kasan stack:
[ 336.432159] BUG: KASAN: slab-out-of-bounds in
ecc_sw_hamming_calculate+0x1dc/0x7d0
[ 336.433634] Read of siz
From: kechengsong
ubifs_jnl_write_inode() probably cause read out-of-bounds in some situation.
There is kasan stack:
[ 336.432159] BUG: KASAN: slab-out-of-bounds in
ecc_sw_hamming_calculate+0x1dc/0x7d0
[ 336.433634] Read of size 4 at addr 888019612ff8 by task kworker/u8:4/135
[ 336.434605
3 matches
Mail list logo