1 files changed, 41 insertions, 6 deletions

diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index fab29f899f91..0ad819c904df 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -331,7 +331,7 @@ void ubifs_pad(const struct ubifs_info *c, void *buf, int pad)
 {
         uint32_t crc;
 
-        ubifs_assert(c, pad >= 0 && !(pad & 7));
+        ubifs_assert(c, pad >= 0);
 
         if (pad >= UBIFS_PAD_NODE_SZ) {
                 struct ubifs_ch *ch = buf;
@@ -728,6 +728,10 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
                  * write-buffer.
                  */
                 memcpy(wbuf->buf + wbuf->used, buf, len);
+                if (aligned_len > len) {
+                        ubifs_assert(c, aligned_len - len < 8);
+                        ubifs_pad(c, wbuf->buf + wbuf->used + len, aligned_len - len);
+                }
 
                 if (aligned_len == wbuf->avail) {
                         dbg_io("flush jhead %s wbuf to LEB %d:%d",
@@ -806,27 +810,58 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len)
          */
         n = aligned_len >> c->max_write_shift;
         if (n) {
-                n <<= c->max_write_shift;
+                int m = n - 1;
+
                 dbg_io("write %d bytes to LEB %d:%d", n, wbuf->lnum,
                        wbuf->offs);
-                err = ubifs_leb_write(c, wbuf->lnum, buf + written,
-                                      wbuf->offs, n);
+
+                if (m) {
+                        /* '(n-1)<<c->max_write_shift < len' is always true. */
+                        m <<= c->max_write_shift;
+                        err = ubifs_leb_write(c, wbuf->lnum, buf + written,
+                                              wbuf->offs, m);
+                        if (err)
+                                goto out;
+                        wbuf->offs += m;
+                        aligned_len -= m;
+                        len -= m;
+                        written += m;
+                }
+
+                /*
+                 * The non-written len of buf may be less than 'n' because
+                 * parameter 'len' is not 8 bytes aligned, so here we read
+                 * min(len, n) bytes from buf.
+                 */
+                n = 1 << c->max_write_shift;
+                memcpy(wbuf->buf, buf + written, min(len, n));
+                if (n > len) {
+                        ubifs_assert(c, n - len < 8);
+                        ubifs_pad(c, wbuf->buf + len, n - len);
+                }
+
+                err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf, wbuf->offs, n);
                 if (err)
                         goto out;
                 wbuf->offs += n;
                 aligned_len -= n;
-                len -= n;
+                len -= min(len, n);
                 written += n;
         }
 
         spin_lock(&wbuf->lock);
-        if (aligned_len)
+        if (aligned_len) {
                 /*
                  * And now we have what's left and what does not take whole
                  * max. write unit, so write it to the write-buffer and we are
                  * done.
                  */
                 memcpy(wbuf->buf, buf + written, len);
+                if (aligned_len > len) {
+                        ubifs_assert(c, aligned_len - len < 8);
+                        ubifs_pad(c, wbuf->buf + len, aligned_len - len);
+                }
+        }
 
         if (c->leb_size - wbuf->offs >= c->max_write_size)
                 wbuf->size = c->max_write_size;