[U-Boot] [PATCH v1] fs: ubifs: Fix UBIFS decompression on 64 bit

[Heiko Schocher]

Hello Paul,

Am 05.11.2018 um 06:09 schrieb Paul Davey:
> Add local size_t variable to crypto_comp_decompress as intermediate
> storage for destination length to avoid memory corruption and incorrect
> results on 64 bit targets.
> 
> This is what linux does for the various lz compression implementations.
> 
> Signed-off-by: Paul Davey <paul.davey at alliedtelesis.co.nz>
> Cc: Heiko Schocher <hs at denx.de>

Does not break any tests, so

Tested-by: Heiko Schocher <hs at denx.de>

I start a travis build, and if successful, send a pull request to Tom, as
this should go into current release ...

bye,
Heiko
> ---
> 
> When attempting to use ubifs on a MIPS64 platform I found that it would fail
> decompression for the file I was attempting to load.
> 
> Further investigation found that this was due to the pointer cast from unsigned
> int * to size_t * in the decompression wrapper.  This will cause any big endian
> 64 bit platform to fail to load any ubifs file that requires decompression and
> at least cause little endian 64 bit platforms to silently write 0 over 4 bytes
> of stack memory.
> 
>   fs/ubifs/ubifs.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ubifs/ubifs.c b/fs/ubifs/ubifs.c
> index 47fa41ad1dd..d5101d3c459 100644
> --- a/fs/ubifs/ubifs.c
> +++ b/fs/ubifs/ubifs.c
> @@ -125,6 +125,7 @@ crypto_comp_decompress(const struct ubifs_info *c, struct crypto_comp *tfm,
>   {
>   	struct ubifs_compressor *compr = ubifs_compressors[tfm->compressor];
>   	int err;
> +	size_t tmp_len = *dlen;
>   
>   	if (compr->compr_type == UBIFS_COMPR_NONE) {
>   		memcpy(dst, src, slen);
> @@ -132,11 +133,12 @@ crypto_comp_decompress(const struct ubifs_info *c, struct crypto_comp *tfm,
>   		return 0;
>   	}
>   
> -	err = compr->decompress(src, slen, dst, (size_t *)dlen);
> +	err = compr->decompress(src, slen, dst, &tmp_len);
>   	if (err)
>   		ubifs_err(c, "cannot decompress %d bytes, compressor %s, "
>   			  "error %d", slen, compr->name, err);
>   
> +	*dlen = tmp_len;
>   	return err;
>   
>   	return 0;
> 

-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: +49-8142-66989-52   Fax: +49-8142-66989-80   Email: hs at denx.de