JFFS2文件系统挂载失败时处理上的漏洞

发布于 2013-08-26 17:03:19 浏览：2235 订阅该版

```c
/*
 * RT-Thread DFS Interface for jffs2
 */
static int dfs_jffs2_mount(struct dfs_filesystem* fs, 
                    unsigned long rwflag, 
				    const void* data)
{
	unsigned index;
	struct cyg_mtab_entry * mte;
	int result;

/* find a empty entry in partition table */
	for (index = 0; index < DEVICE_PART_MAX; index ++)
	{
		if (device_partition[index].dev == RT_NULL)
			break;
	}
	if (index == DEVICE_PART_MAX) 
		return -DFS_STATUS_ENOSPC;

mte = rt_malloc(sizeof(struct cyg_mtab_entry));
	if (mte == RT_NULL)
		return -DFS_STATUS_ENOMEM;

mte->name = fs->path;
	mte->fsname = "jffs2";
	mte->devname = NULL;
	/* note that, i use mte->data to store rtt's device 
	 * while, in jffs2_mount, mte->data will be copy into
	 * s_dev in struct super_block, and mte->data will be
	 * filled with jffs2_sb(see the source of jffs2_mount.
	 */
	mte->data = (CYG_ADDRWORD)fs->dev_id;

device_partition[index].dev = RT_MTD_DEVICE(fs->dev_id);
	/* after jffs2_mount, mte->data will not be dev_id any more */
	result = jffs2_mount(NULL, mte);
	if (result != 0)
	{	
		return jffs2_result_to_dfs(result);
	}
	/* save this pointer */
	device_partition[index].mte = mte;	
	return 0;
}
```
此处文件系统挂载失败，有漏洞，需要在挂在失败时检查device_partition[index].dev   并在
```c
	if (result != 0)
	{	
		return jffs2_result_to_dfs(result);
	}
```
时将已经找到的设备移除掉，否则下次挂载的时候，如果仅允许一个`partition table`就会挂载不成功 [s:186]