Received-SPF: pass (google.com: domain of linux-kernel+bounces-145589-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Message-ID: <74f2b16a-dd48-4306-b28b-ad5ba77d8bfe@elkcl.ru>
Date: Mon, 15 Apr 2024 19:50:23 +0300
Precedence: bulk
MIME-Version: 1.0
User-Agent: Betterbird (Linux)
Subject: Re: [PATCH] jffs2: prevent xattr node from overflowing the eraseblock
To: Christian Brauner <brauner@kernel.org>
Cc: David Woodhouse <dwmw2@infradead.org>, Richard Weinberger
 <richard@nod.at>, Zhihao Cheng <chengzhihao1@huawei.com>,
 Fabian Frederick <fabf@skynet.be>, Nick Desaulniers
 <ndesaulniers@google.com>, Wedson Almeida Filho <walmeida@microsoft.com>,
 KaiGai Kohei <kaigai@ak.jp.nec.com>, linux-mtd@lists.infradead.org,
 linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org
References: <20240412155357.237803-1-dev@elkcl.ru>
 <20240415-anspielen-gelyncht-d2f0efd6569e@brauner>
From: Ilya Denisyev <dev@elkcl.ru>
Content-Language: en-US
In-Reply-To: <20240415-anspielen-gelyncht-d2f0efd6569e@brauner>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Sender: pub@elkcl.ru

On 15.04.2024 17:28, Christian Brauner wrote:
> Can this overflow? I.e. can c->sector_size be smaller than c->cleanmarker_size?

I'm pretty sure that it can't. As far as I know, c->sector_size is at 
least the MTD eraseblock size[1] or even bigger in the case of 
DataFlash[2]. The cleanmarker is either the size of the smallest JFFS2 
node[3] (currently 12 bytes), 0 bytes for certain flash types (like 
NAND, where it's stored out of band[4]) or apparently at most the MTD 
writesize (which, as far as I understand, is not larger than the 
erasesize) for Intel Sibley[5].

Considering that any JFFS2 node must fit inside one block and that the 
cleanmarker is the smallest node there is (if it's even a proper node), 
it shouldn't overflow, otherwise JFFS2 won't work in the first place.


[1] https://elixir.bootlin.com/linux/v6.9-rc4/source/fs/jffs2/fs.c#L539

[2] https://elixir.bootlin.com/linux/v6.9-rc4/source/fs/jffs2/wbuf.c#L1253

[3] https://elixir.bootlin.com/linux/v6.9-rc4/source/fs/jffs2/fs.c#L557

[4] https://elixir.bootlin.com/linux/v6.9-rc4/source/fs/jffs2/wbuf.c#L1190

[5] https://elixir.bootlin.com/linux/v6.9-rc4/source/fs/jffs2/wbuf.c#L1296


---

Best regards,

Ilya