Commit 61a56099 authored by Zhihao Cheng's avatar Zhihao Cheng Committed by Zhihao Cheng
Browse files

ubifs: ubifs_link: Fix wrong name len calculating when UBIFS is encrypted 

mainline inclusion
from mainline-v6.7-rc1
commit 75690493591fe283e4c92a3ba7c4420e9858abdb
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9T4OL

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=75690493591fe283e4c92a3ba7c4420e9858abdb



----------------------------------------------------------------------

The length of dentry name is calculated after the raw name is encrypted,
except for ubifs_link(), which could make the size of dir underflow.
Here is a reproducer:

 touch $TMP/file
 mkdir $TMP/dir
 stat $TMP/dir
 for i in $(seq 1 8)
 do
   ln $TMP/file $TMP/dir/$i
   unlink $TMP/dir/$i
 done
 stat $TMP/dir

The size of dir will be underflow(-96).

Fix it by calculating dentry name's length after the name is encrypted.

Fixes: f4f61d2c ("ubifs: Implement encrypted filenames")
Reported-by: default avatarRoland Ruckerbauer <roland.ruckerbauer@robart.cc>
Link: https://lore.kernel.org/linux-mtd/1638777819.2925845.1695222544742.JavaMail.zimbra@robart.cc/T/#u


Signed-off-by: default avatarZhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
Signed-off-by: default avatarZhihao Cheng <chengzhihao@huaweicloud.com>
parent 0a8d8bc5

fs/ubifs/dir.c

+3 −1
Original line number Diff line number Diff line
@@ -724,7 +724,7 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir, 
	struct inode *inode = d_inode(old_dentry);

	struct ubifs_inode *ui = ubifs_inode(inode);

	struct ubifs_inode *dir_ui = ubifs_inode(dir);

	int err, sz_change = CALC_DENT_SIZE(dentry->d_name.len);

	int err, sz_change;

	struct ubifs_budget_req req = { .new_dent = 1, .dirtied_ino = 2,

				.dirtied_ino_d = ALIGN(ui->data_len, 8) };

	struct fscrypt_name nm;
@@ -748,6 +748,8 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir, 
	if (err)

		return err;



	sz_change = CALC_DENT_SIZE(fname_len(&nm));



	err = dbg_check_synced_i_size(c, inode);

	if (err)

		goto out_fname;