Kamlakant Patel 3367da5610 jffs2: Fix segmentation fault found in stress test ... Creating a large file on a JFFS2 partition sometimes crashes with this call trace: [ 306.476000] CPU 13 Unable to handle kernel paging request at virtual address c0000000dfff8002, epc == ffffffffc03a80a8, ra == ffffffffc03a8044 [ 306.488000] Oops[#1]: [ 306.488000] Cpu 13 [ 306.492000] $ 0 : 0000000000000000 0000000000000000 0000000000008008 0000000000008007 [ 306.500000] $ 4 : c0000000dfff8002 000000000000009f c0000000e0007cde c0000000ee95fa58 [ 306.508000] $ 8 : 0000000000000001 0000000000008008 0000000000010000 ffffffffffff8002 [ 306.516000] $12 : 0000000000007fa9 000000000000ff0e 000000000000ff0f 80e55930aebb92bb [ 306.524000] $16 : c0000000e0000000 c0000000ee95fa5c c0000000efc80000 ffffffffc09edd70 [ 306.532000] $20 : ffffffffc2b60000 c0000000ee95fa58 0000000000000000 c0000000efc80000 [ 306.540000] $24 : 0000000000000000 0000000000000004 [ 306.548000] $28 : c0000000ee950000 c0000000ee95f738 0000000000000000 ffffffffc03a8044 [ 306.556000] Hi : 00000000000574a5 [ 306.560000] Lo : 6193b7a7e903d8c9 [ 306.564000] epc : ffffffffc03a80a8 jffs2_rtime_compress+0x98/0x198 [ 306.568000] Tainted: G W [ 306.572000] ra : ffffffffc03a8044 jffs2_rtime_compress+0x34/0x198 [ 306.580000] Status: 5000f8e3 KX SX UX KERNEL EXL IE [ 306.584000] Cause : 00800008 [ 306.588000] BadVA : c0000000dfff8002 [ 306.592000] PrId : 000c1100 (Netlogic XLP) [ 306.596000] Modules linked in: [ 306.596000] Process dd (pid: 170, threadinfo=c0000000ee950000, task=c0000000ee6e0858, tls=0000000000c47490) [ 306.608000] Stack : 7c547f377ddc7ee4 7ffc7f967f5d7fae 7f617f507fc37ff4 7e7d7f817f487f5f 7d8e7fec7ee87eb3 7e977ff27eec7f9e 7d677ec67f917f67 7f3d7e457f017ed7 7fd37f517f867eb2 7fed7fd17ca57e1d 7e5f7fe87f257f77 7fd77f0d7ede7fdb 7fba7fef7e197f99 7fde7fe07ee37eb5 7f5c7f8c7fc67f65 7f457fb87f847e93 7f737f3e7d137cd9 7f8e7e9c7fc47d25 7dbb7fac7fb67e52 7ff17f627da97f64 7f6b7df77ffa7ec5 80057ef17f357fb3 7f767fa27dfc7fd5 7fe37e8e7fd07e53 7e227fcf7efb7fa1 7f547e787fa87fcc 7fcb7fc57f5a7ffb 7fc07f6c7ea97e80 7e2d7ed17e587ee0 7fb17f9d7feb7f31 7f607e797e887faa 7f757fdd7c607ff3 7e877e657ef37fbd 7ec17fd67fe67ff7 7ff67f797ff87dc4 7eef7f3a7c337fa6 7fe57fc97ed87f4b 7ebe7f097f0b8003 7fe97e2a7d997cba 7f587f987f3c7fa9 ... [ 306.676000] Call Trace: [ 306.680000] [<ffffffffc03a80a8>] jffs2_rtime_compress+0x98/0x198 [ 306.684000] [<ffffffffc0394f10>] jffs2_selected_compress+0x110/0x230 [ 306.692000] [<ffffffffc039508c>] jffs2_compress+0x5c/0x388 [ 306.696000] [<ffffffffc039dc58>] jffs2_write_inode_range+0xd8/0x388 [ 306.704000] [<ffffffffc03971bc>] jffs2_write_end+0x16c/0x2d0 [ 306.708000] [<ffffffffc01d3d90>] generic_file_buffered_write+0xf8/0x2b8 [ 306.716000] [<ffffffffc01d4e7c>] __generic_file_aio_write+0x1ac/0x350 [ 306.720000] [<ffffffffc01d50a0>] generic_file_aio_write+0x80/0x168 [ 306.728000] [<ffffffffc021f7dc>] do_sync_write+0x94/0xf8 [ 306.732000] [<ffffffffc021ff6c>] vfs_write+0xa4/0x1a0 [ 306.736000] [<ffffffffc02202e8>] SyS_write+0x50/0x90 [ 306.744000] [<ffffffffc0116cc0>] handle_sys+0x180/0x1a0 [ 306.748000] [ 306.748000] Code: 020b202d 0205282d 90a50000 <90840000> 14a40038 00000000 0060602d 0000282d 016c5823 [ 306.760000] ---[ end trace 79dd088435be02d0 ]--- Segmentation fault This crash is caused because the 'positions' is declared as an array of signed short. The value of position is in the range 0..65535, and will be converted to a negative number when the position is greater than 32767 and causes a corruption and crash. Changing the definition to 'unsigned short' fixes this issue Signed-off-by: Jayachandran C <jchandra@broadcom.com> Signed-off-by: Kamlakant Patel <kamlakant.patel@broadcom.com> Cc: <stable@vger.kernel.org> Signed-off-by: Brian Norris <computersforpeace@gmail.com>		2014-03-10 22:42:28 -07:00
..
9p	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-01-28 08:38:04 -08:00
adfs	adfs: delayed freeing of sbi	2013-10-24 23:43:27 -04:00
affs	affs: use ->kill_sb() to simplify ->put_super() and failure exits of ->mount()	2014-01-25 03:13:01 -05:00
afs	afs: proc cells and rootcell are writeable	2014-02-01 10:59:39 -08:00
autofs4	autofs: fix symlinks aren't checked for expiry	2014-01-23 16:36:59 -08:00
befs	befs: iget_locked() doesn't return an ERR_PTR	2014-01-25 03:14:38 -05:00
bfs	truncate: drop 'oldsize' truncate_pagecache() parameter	2013-09-12 15:38:02 -07:00
btrfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2014-02-16 11:05:27 -08:00
cachefiles	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-11-13 15:34:18 +09:00
ceph	ceph: fix __dcache_readdir()	2014-02-17 12:37:13 -08:00
cifs	Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6	2014-02-17 13:50:11 -08:00
coda	coda_revalidate_inode(): switch to passing inode...	2013-11-09 00:16:21 -05:00
configfs	configfs: fix race between dentry put and lookup	2013-11-21 16:42:27 -08:00
cramfs	cramfs: take headers to fs/cramfs	2014-01-25 03:13:02 -05:00
debugfs	debugfs: use list_next_entry() in debugfs_remove_recursive()	2013-11-13 12:09:24 +09:00
devpts	devpts: plug the memory leak in kill_sb	2013-11-13 12:09:36 +09:00
dlm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-01-25 11:17:34 -08:00
ecryptfs	ecryptfs: fix failure handling in ->readlink()	2014-01-25 03:13:00 -05:00
efivarfs	consolidate simple ->d_delete() instances	2013-11-15 22:04:17 -05:00
efs	efs: get rid of ->put_super()	2014-01-25 03:13:02 -05:00
exofs	exofs: Print less in r4w	2014-01-23 18:54:14 +02:00
exportfs	exportfs: fix quadratic behavior in filehandle lookup	2013-11-09 00:16:38 -05:00
ext2	ext2/3/4: use generic posix ACL infrastructure	2014-01-25 23:58:19 -05:00
ext3	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-01-28 08:38:04 -08:00
ext4	ext4: don't leave i_crtime.tv_sec uninitialized	2014-02-16 19:29:32 -05:00
f2fs	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
fat	fat: rcu-delay unloading nls and freeing sbi	2013-10-24 23:43:28 -04:00
freevxfs
fscache	FS-Cache: Handle removal of unadded object to the fscache_object_list rb tree	2014-02-17 13:47:35 -08:00
fuse	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-01-28 08:38:04 -08:00
gfs2	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
hfs	fs/hfs/btree.h: remove duplicate defines	2013-11-13 12:09:32 +09:00
hfsplus	hfsplus: fix remount issue	2014-03-04 07:55:49 -08:00
hostfs	um: hostfs: make functions static	2014-01-26 11:51:09 +01:00
hpfs	hpfs: optimize quad buffer loading	2014-02-02 16:24:07 -08:00
hppfs	clean up scary strncpy(dst, src, strlen(src)) uses	2013-07-03 16:07:41 -07:00
hugetlbfs	cope with potentially long ->d_dname() output for shmem/hugetlb	2013-08-24 12:10:17 -04:00
isofs	isofs: don't pass dentry to isofs_hash{i,}_common()	2013-10-24 23:34:59 -04:00
jbd	jbd: Revise KERN_EMERG error messages	2013-12-04 12:27:46 +01:00
jbd2	jbd2: fix use after free in jbd2_journal_start_reserved()	2014-02-17 20:33:01 -05:00
jffs2	jffs2: Fix segmentation fault found in stress test	2014-03-10 22:42:28 -07:00
jfs	jfs: set i_ctime when setting ACL	2014-02-13 15:56:05 -06:00
kernfs	sysfs: fix namespace refcnt leak	2014-02-25 07:37:52 -08:00
lockd	lockd: send correct lock when granting a delayed lock.	2014-02-13 14:55:02 -05:00
logfs	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
minix	fs/minix: Drop dependency on H8300	2013-09-16 18:20:25 -07:00
ncpfs	ncpfs: rcu-delay unload_nls() and freeing ncp_server	2013-10-24 23:43:28 -04:00
nfs	NFS client bugfixes for Linux 3.14	2014-03-09 19:17:39 -07:00
nfs_common
nfsd	nfsd4: fix acl buffer overrun	2014-02-11 13:48:11 -05:00
nilfs2	Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block	2014-01-30 11:19:05 -08:00
nls	nls: have register_nls() set ->owner	2014-01-25 03:14:05 -05:00
notify	fsnotify: Allocate overflow events with proper type	2014-02-25 11:18:06 +01:00
ntfs	fix O_SYNC|O_APPEND syncing the wrong range on write()	2014-02-09 15:18:09 -05:00
ocfs2	ocfs2: fix quota file corruption	2014-03-04 07:55:48 -08:00
omfs	truncate: drop 'oldsize' truncate_pagecache() parameter	2013-09-12 15:38:02 -07:00
openpromfs
proc	mm: close PageTail race	2014-03-04 07:55:47 -08:00
pstore	pstore: Don't allow high traffic options on fragile devices	2013-12-20 13:12:01 -08:00
qnx4	qnx4: clean qnx4_fill_super() up	2014-01-25 03:13:03 -05:00
qnx6
quota	quota: Fix race between dqput() and dquot_scan_active()	2014-02-20 21:57:04 +01:00
ramfs	fs/ramfs: move ramfs_aops to inode.c	2014-01-23 16:36:58 -08:00
reiserfs	reiserfs: fix utterly brain-damaged indentation.	2014-02-17 13:46:33 -08:00
romfs	romfs: fix returm err while getting inode in fill_super	2014-01-23 16:37:04 -08:00
squashfs	Squashfs: fix failure to unlock pages on decompress error	2013-11-24 01:02:50 +00:00
sysfs	sysfs: fix namespace refcnt leak	2014-02-25 07:37:52 -08:00
sysv	sysv: Add forgotten superblock lock init for v7 fs	2013-09-29 22:02:02 -04:00
ubifs	fs/ubifs: use rbtree postorder iteration helper instead of opencoding	2014-01-23 16:37:03 -08:00
udf	udf: Fix data corruption on file type conversion	2014-02-20 21:56:00 +01:00
ufs	truncate: drop 'oldsize' truncate_pagecache() parameter	2013-09-12 15:38:02 -07:00
xfs	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs	2014-02-27 10:37:22 -08:00
aio.c	Merge git://git.kvack.org/~bcrl/aio-next	2013-12-22 11:03:49 -08:00
anon_inodes.c	... and kill anon_inode_getfile_private()	2013-11-09 00:16:28 -05:00
attr.c	fs: fix iversion handling	2013-12-05 16:36:21 -06:00
bad_inode.c
binfmt_aout.c	dump_skip(): dump_seek() replacement taking coredump_params	2013-11-09 00:16:26 -05:00
binfmt_elf.c	fs: binfmt_elf: remove unused defines INTERPRETER_NONE and INTERPRETER_ELF	2014-01-23 16:36:58 -08:00
binfmt_elf_fdpic.c	elf{,_fdpic} coredump: get rid of pointless if (siginfo->si_signo)	2013-11-09 00:16:30 -05:00
binfmt_em86.c	file->f_op is never NULL...	2013-10-24 23:34:54 -04:00
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
binfmt_som.c
bio-integrity.c	bio-integrity: Drop bio_integrity_verify BUG_ON in post bip->bip_iter world	2014-02-21 15:56:36 -08:00
bio.c	block: Fix cloning of discard/write same bios	2014-02-11 08:40:45 -07:00
block_dev.c	a trivial writeback fix	2013-09-13 23:06:40 -04:00
buffer.c	mm: __set_page_dirty uses spin_lock_irqsave instead of spin_lock_irq	2014-02-06 13:48:51 -08:00
char_dev.c	Merge branch 'for-3.13/core' of git://git.kernel.dk/linux-block	2013-11-14 12:08:14 +09:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c	fs/compat_ioctl.c: fix an underflow issue (harmless)	2014-01-21 16:19:42 -08:00
coredump.c	coredump: make __get_dumpable/get_dumpable inline, kill fs/coredump.h	2014-01-23 16:37:01 -08:00
dcache.c	__dentry_path() fixes	2014-01-26 12:37:55 -05:00
dcookies.c	fs/compat: fix lookup_dcookie() parameter handling	2014-01-29 16:22:40 -08:00
direct-io.c	block: Abstract out bvec iterator	2013-11-23 22:33:47 -08:00
drop_caches.c	shrinker: add node awareness	2013-09-10 18:56:31 -04:00
eventfd.c	eventfd_ctx_fdget(): use fdget() instead of fget()	2014-01-25 03:13:04 -05:00
eventpoll.c	epoll: do not take the nested ep->mtx on EPOLL_CTL_DEL	2014-01-02 14:40:30 -08:00
exec.c	execve: use 'struct filename *' for executable name passing	2014-02-05 12:54:53 -08:00
fcntl.c	file->f_op is never NULL...	2013-10-24 23:34:54 -04:00
fhandle.c
file.c	fs/file.c:fdtable: avoid triggering OOMs from alloc_fdmem	2014-02-10 16:01:41 -08:00
file_table.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-11-13 15:34:18 +09:00
filesystems.c
fs-writeback.c	Revert "writeback: do not sync data dirtied after sync start"	2014-02-22 02:02:28 +01:00
fs_struct.c	seqcount: Add lockdep functionality to seqcount/seqlock structures	2013-11-06 12:40:26 +01:00
inode.c	locks: break delegations on any attribute modification	2013-11-09 00:16:44 -05:00
internal.h	get rid of s_files and files_lock	2013-11-09 00:16:20 -05:00
ioctl.c	file->f_op is never NULL...	2013-10-24 23:34:54 -04:00
ioprio.c
Kconfig	fs: remove generic_acl	2014-01-26 08:26:40 -05:00
Kconfig.binfmt
libfs.c	consolidate simple ->d_delete() instances	2013-11-15 22:04:17 -05:00
locks.c	locks: missing unlock on error in generic_add_lease()	2013-11-13 07:30:53 -05:00
Makefile	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-01-28 08:38:04 -08:00
mbcache.c	fs: convert fs shrinkers to new scan/count API	2013-09-10 18:56:31 -04:00
mount.h	vfs: Is mounted should be testing mnt_ns for NULL or error.	2014-01-26 08:26:42 -05:00
mpage.c	block: Abstract out bvec iterator	2013-11-23 22:33:47 -08:00
namei.c	execve: use 'struct filename *' for executable name passing	2014-02-05 12:54:53 -08:00
namespace.c	Driver core / sysfs patches for 3.14-rc1	2014-01-20 15:49:44 -08:00
no-block.c
open.c	locks: break delegations on any attribute modification	2013-11-09 00:16:44 -05:00
pipe.c	fs/pipe.c: skip file_update_time on frozen fs	2014-01-23 16:37:00 -08:00
pnode.c	split __lookup_mnt() in two functions	2013-10-24 23:35:00 -04:00
pnode.h	vfs: Don't copy mount bind mounts of /proc/<pid>/ns/mnt between namespaces	2013-08-26 18:42:15 -07:00
posix_acl.c	fs: get_acl() must be allowed to return EOPNOTSUPP	2014-02-03 17:12:37 -05:00
proc_namespace.c	fs/proc_namespace.c: simplify testing nsp and nsp->mnt_ns	2014-01-23 16:37:02 -08:00
read_write.c	fs/compat: fix parameter handling for compat readv/writev syscalls	2014-01-29 16:22:39 -08:00
readdir.c	file->f_op is never NULL...	2013-10-24 23:34:54 -04:00
select.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-11-13 15:34:18 +09:00
seq_file.c	seq_file: always clear m->count when we free m->buf	2013-11-18 19:07:53 -08:00
signalfd.c
splice.c	fuse: fix pipe_buf_operations	2014-01-22 19:36:57 +01:00
stack.c
stat.c	vfs: split out vfs_getattr_nosec	2013-11-09 00:16:31 -05:00
statfs.c	vfs: allow O_PATH file descriptors for fstatfs()	2013-10-12 13:12:31 -07:00
super.c	fs/super.c: sync ro remount after blocking writers	2014-01-31 14:29:36 -05:00
sync.c	Revert "writeback: do not sync data dirtied after sync start"	2014-02-22 02:02:28 +01:00
timerfd.c
utimes.c	locks: break delegations on any attribute modification	2013-11-09 00:16:44 -05:00
xattr.c