5 files changed, 55 insertions, 9 deletions

diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index 054363f2b207..40e2790b62ce 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -74,6 +74,7 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
  * @lnum: logical eraseblock number
  * @offs: offset within the logical eraseblock
  * @quiet: print no messages
+ * @chk_crc: indicates whether to always check the CRC
  *
  * This function checks node magic number and CRC checksum. This function also
  * validates node length to prevent UBIFS from becoming crazy when an attacker
@@ -85,7 +86,7 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
  * or magic.
  */
 int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
-                     int offs, int quiet)
+                     int offs, int quiet, int chk_crc)
 {
         int err = -EINVAL, type, node_len;
         uint32_t crc, node_crc, magic;
@@ -121,6 +122,10 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
                    node_len > c->ranges[type].max_len)
                 goto out_len;
 
+        if (!chk_crc && type == UBIFS_DATA_NODE && !c->always_chk_crc)
+                if (c->no_chk_data_crc)
+                        return 0;
+
         crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
         node_crc = le32_to_cpu(ch->crc);
         if (crc != node_crc) {
@@ -722,7 +727,7 @@ int ubifs_read_node_wbuf(struct ubifs_wbuf *wbuf, void *buf, int type, int len,
                 goto out;
         }
 
-        err = ubifs_check_node(c, buf, lnum, offs, 0);
+        err = ubifs_check_node(c, buf, lnum, offs, 0, 0);
         if (err) {
                 ubifs_err("expected node type %d", type);
                 return err;
@@ -781,7 +786,7 @@ int ubifs_read_node(const struct ubifs_info *c, void *buf, int type, int len,
                 goto out;
         }
 
-        err = ubifs_check_node(c, buf, lnum, offs, 0);
+        err = ubifs_check_node(c, buf, lnum, offs, 0, 0);
         if (err) {
                 ubifs_err("expected node type %d", type);
                 return err;
diff --git a/fs/ubifs/scan.c b/fs/ubifs/scan.c
index acf5c5fffc60..0ed82479b44b 100644
--- a/fs/ubifs/scan.c
+++ b/fs/ubifs/scan.c
@@ -87,7 +87,7 @@ int ubifs_scan_a_node(const struct ubifs_info *c, void *buf, int len, int lnum,
 
         dbg_scan("scanning %s", dbg_ntype(ch->node_type));
 
-        if (ubifs_check_node(c, buf, lnum, offs, quiet))
+        if (ubifs_check_node(c, buf, lnum, offs, quiet, 1))
                 return SCANNED_A_CORRUPT_NODE;
 
         if (ch->node_type == UBIFS_PAD_NODE) {
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index b1c57e8ee855..cf078b5cc88c 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -406,6 +406,11 @@ static int ubifs_show_options(struct seq_file *s, struct vfsmount *mnt)
         else if (c->mount_opts.bulk_read == 1)
                 seq_printf(s, ",no_bulk_read");
 
+        if (c->mount_opts.chk_data_crc == 2)
+                seq_printf(s, ",chk_data_crc");
+        else if (c->mount_opts.chk_data_crc == 1)
+                seq_printf(s, ",no_chk_data_crc");
+
         return 0;
 }
 
@@ -859,6 +864,8 @@ static int check_volume_empty(struct ubifs_info *c)
  * Opt_norm_unmount: run a journal commit before un-mounting
  * Opt_bulk_read: enable bulk-reads
  * Opt_no_bulk_read: disable bulk-reads
+ * Opt_chk_data_crc: check CRCs when reading data nodes
+ * Opt_no_chk_data_crc: do not check CRCs when reading data nodes
  * Opt_err: just end of array marker
  */
 enum {
@@ -866,6 +873,8 @@ enum {
         Opt_norm_unmount,
         Opt_bulk_read,
         Opt_no_bulk_read,
+        Opt_chk_data_crc,
+        Opt_no_chk_data_crc,
         Opt_err,
 };
 
@@ -874,6 +883,8 @@ static match_table_t tokens = {
         {Opt_norm_unmount, "norm_unmount"},
         {Opt_bulk_read, "bulk_read"},
         {Opt_no_bulk_read, "no_bulk_read"},
+        {Opt_chk_data_crc, "chk_data_crc"},
+        {Opt_no_chk_data_crc, "no_chk_data_crc"},
         {Opt_err, NULL},
 };
 
@@ -919,6 +930,14 @@ static int ubifs_parse_options(struct ubifs_info *c, char *options,
                         c->mount_opts.bulk_read = 1;
                         c->bulk_read = 0;
                         break;
+                case Opt_chk_data_crc:
+                        c->mount_opts.chk_data_crc = 2;
+                        c->no_chk_data_crc = 0;
+                        break;
+                case Opt_no_chk_data_crc:
+                        c->mount_opts.chk_data_crc = 1;
+                        c->no_chk_data_crc = 1;
+                        break;
                 default:
                         ubifs_err("unrecognized mount option \"%s\" "
                                   "or missing value", p);
@@ -1027,6 +1046,8 @@ static int mount_ubifs(struct ubifs_info *c)
                         goto out_free;
         }
 
+        c->always_chk_crc = 1;
+
         err = ubifs_read_superblock(c);
         if (err)
                 goto out_free;
@@ -1168,6 +1189,8 @@ static int mount_ubifs(struct ubifs_info *c)
         if (err)
                 goto out_infos;
 
+        c->always_chk_crc = 0;
+
         ubifs_msg("mounted UBI device %d, volume %d, name \"%s\"",
                   c->vi.ubi_num, c->vi.vol_id, c->vi.name);
         if (mounted_read_only)
@@ -1313,6 +1336,7 @@ static int ubifs_remount_rw(struct ubifs_info *c)
 
         mutex_lock(&c->umount_mutex);
         c->remounting_rw = 1;
+        c->always_chk_crc = 1;
 
         /* Check for enough free space */
         if (ubifs_calc_available(c, c->min_idx_lebs) <= 0) {
@@ -1381,13 +1405,15 @@ static int ubifs_remount_rw(struct ubifs_info *c)
                 c->bgt = NULL;
                 ubifs_err("cannot spawn \"%s\", error %d",
                           c->bgt_name, err);
-                return err;
+                goto out;
         }
         wake_up_process(c->bgt);
 
         c->orph_buf = vmalloc(c->leb_size);
-        if (!c->orph_buf)
-                return -ENOMEM;
+        if (!c->orph_buf) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         /* Check for enough log space */
         lnum = c->lhead_lnum + 1;
@@ -1414,6 +1440,7 @@ static int ubifs_remount_rw(struct ubifs_info *c)
         dbg_gen("re-mounted read-write");
         c->vfs_sb->s_flags &= ~MS_RDONLY;
         c->remounting_rw = 0;
+        c->always_chk_crc = 0;
         mutex_unlock(&c->umount_mutex);
         return 0;
 
@@ -1429,6 +1456,7 @@ out:
         c->ileb_buf = NULL;
         ubifs_lpt_free(c, 1);
         c->remounting_rw = 0;
+        c->always_chk_crc = 0;
         mutex_unlock(&c->umount_mutex);
         return err;
 }
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index d279012d8dd5..66dc57100bdf 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -470,6 +470,10 @@ static int try_read_node(const struct ubifs_info *c, void *buf, int type,
         if (node_len != len)
                 return 0;
 
+        if (type == UBIFS_DATA_NODE && !c->always_chk_crc)
+                if (c->no_chk_data_crc)
+                        return 0;
+
         crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
         node_crc = le32_to_cpu(ch->crc);
         if (crc != node_crc)
@@ -1687,7 +1691,7 @@ static int validate_data_node(struct ubifs_info *c, void *buf,
                 goto out_err;
         }
 
-        err = ubifs_check_node(c, buf, zbr->lnum, zbr->offs, 0);
+        err = ubifs_check_node(c, buf, zbr->lnum, zbr->offs, 0, 0);
         if (err) {
                 ubifs_err("expected node type %d", UBIFS_DATA_NODE);
                 goto out;
diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
index 8513239ea8a0..d6ae3f7b2b05 100644
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -894,10 +894,12 @@ struct ubifs_orphan {
  * struct ubifs_mount_opts - UBIFS-specific mount options information.
  * @unmount_mode: selected unmount mode (%0 default, %1 normal, %2 fast)
  * @bulk_read: enable bulk-reads
+ * @chk_data_crc: check CRCs when reading data nodes
  */
 struct ubifs_mount_opts {
         unsigned int unmount_mode:2;
         unsigned int bulk_read:2;
+        unsigned int chk_data_crc:2;
 };
 
 /**
@@ -1001,6 +1003,9 @@ struct ubifs_mount_opts {
  * @bulk_read: enable bulk-reads
  * @bulk_read_buf_size: buffer size for bulk-reads
  *
+ * @no_chk_data_crc: do not check CRCs when reading data nodes (except during
+ *                   recovery)
+ *
  * @dirty_pg_cnt: number of dirty pages (not used)
  * @dirty_zn_cnt: number of dirty znodes
  * @clean_zn_cnt: number of clean znodes
@@ -1138,6 +1143,7 @@ struct ubifs_mount_opts {
  * @rcvrd_mst_node: recovered master node to write when mounting ro to rw
  * @size_tree: inode size information for recovery
  * @remounting_rw: set while remounting from ro to rw (sb flags have MS_RDONLY)
+ * @always_chk_crc: always check CRCs (while mounting and remounting rw)
  * @mount_opts: UBIFS-specific mount options
  *
  * @dbg_buf: a buffer of LEB size used for debugging purposes
@@ -1244,6 +1250,8 @@ struct ubifs_info {
         int bulk_read;
         int bulk_read_buf_size;
 
+        int no_chk_data_crc;
+
         atomic_long_t dirty_pg_cnt;
         atomic_long_t dirty_zn_cnt;
         atomic_long_t clean_zn_cnt;
@@ -1374,6 +1382,7 @@ struct ubifs_info {
         struct ubifs_mst_node *rcvrd_mst_node;
         struct rb_root size_tree;
         int remounting_rw;
+        int always_chk_crc;
         struct ubifs_mount_opts mount_opts;
 
 #ifdef CONFIG_UBIFS_FS_DEBUG
@@ -1416,7 +1425,7 @@ int ubifs_read_node_wbuf(struct ubifs_wbuf *wbuf, void *buf, int type, int len,
 int ubifs_write_node(struct ubifs_info *c, void *node, int len, int lnum,
                      int offs, int dtype);
 int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
-                     int offs, int quiet);
+                     int offs, int quiet, int chk_crc);
 void ubifs_prepare_node(struct ubifs_info *c, void *buf, int len, int pad);
 void ubifs_prep_grp_node(struct ubifs_info *c, void *node, int len, int last);
 int ubifs_io_init(struct ubifs_info *c);