Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Joakim Tjernlund <Joakim.Tjernlund@infinera.com>
To:     Zhe Li <lizhe67@huawei.com>, "richard@nod.at" <richard@nod.at>,
        "dwmw2@infradead.org" <dwmw2@infradead.org>,
        "linux-mtd@lists.infradead.org" <linux-mtd@lists.infradead.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
CC:     "wangfangpeng1@huawei.com" <wangfangpeng1@huawei.com>,
        "xukunkun1@huawei.com" <xukunkun1@huawei.com>,
        "zhongjubin@huawei.com" <zhongjubin@huawei.com>,
        "chenjie6@huawei.com" <chenjie6@huawei.com>
Subject: Re: [PATCH] jffs2: fix kasan slab-out-of-bounds problem
Thread-Topic: [PATCH] jffs2: fix kasan slab-out-of-bounds problem
Thread-Index: AQHXG6TtC8xnwV9O+02ylI57ffrSdKqQdg+D
Date:   Mon, 22 Mar 2021 20:07:37 +0000
Message-ID: <CY4PR1001MB2389E99ECB5B04A65BE35E22F4659@CY4PR1001MB2389.namprd10.prod.outlook.com>
References: <20210318030657.22840-1-lizhe67@huawei.com>
In-Reply-To: <20210318030657.22840-1-lizhe67@huawei.com>
Accept-Language: en-GB, en-US
Content-Language: en-GB
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: e640d3bb-50c6-4c30-2844-08d8ed6e23b2
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Mar 2021 20:07:37.2267
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 285643de-5f5b-4b03-a153-0ae2dc8aaf77
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: r280XigVAZDxPnBgFjzBy0c0+cTvNYJ8K+rfbXkwKJFVPzkk7D2HJb2W3n9Cmy7rSofCyvc3r+7CCjtAxAdT5w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR10MB1398
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Reviewe-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>=0A=
=0A=
It would be interesting to known how you managed to create such a dir entry=
 as that is a bug too.=0A=
________________________________________=0A=
From: linux-mtd <linux-mtd-bounces@lists.infradead.org> on behalf of Zhe Li=
 <lizhe67@huawei.com>=0A=
Sent: 18 March 2021 04:06=0A=
To: richard@nod.at; dwmw2@infradead.org; linux-mtd@lists.infradead.org; lin=
ux-kernel@vger.kernel.org=0A=
Cc: lizhe67@huawei.com; wangfangpeng1@huawei.com; xukunkun1@huawei.com; zho=
ngjubin@huawei.com; chenjie6@huawei.com=0A=
Subject: [PATCH] jffs2: fix kasan slab-out-of-bounds problem=0A=
=0A=
From: lizhe <lizhe67@huawei.com>=0A=
=0A=
KASAN report a slab-out-of-bounds problem. The logs are listed below.=0A=
It is because in function jffs2_scan_dirent_node, we alloc "checkedlen+1"=
=0A=
bytes for fd->name and we check crc with length rd->nsize. If checkedlen=0A=
is less than rd->nsize, it will cause the slab-out-of-bounds problem.=0A=
=0A=
jffs2: Dirent at *** has zeroes in name. Truncating to %d char=0A=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A=
BUG: KASAN: slab-out-of-bounds in crc32_le+0x1ce/0x260 at addr ffff8800842c=
f2d1=0A=
Read of size 1 by task test_JFFS2/915=0A=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=0A=
BUG kmalloc-64 (Tainted: G    B      O   ): kasan: bad access detected=0A=
---------------------------------------------------------------------------=
--=0A=
INFO: Allocated in jffs2_alloc_full_dirent+0x2a/0x40 age=3D0 cpu=3D1 pid=3D=
915=0A=
        ___slab_alloc+0x580/0x5f0=0A=
        __slab_alloc.isra.24+0x4e/0x64=0A=
        __kmalloc+0x170/0x300=0A=
        jffs2_alloc_full_dirent+0x2a/0x40=0A=
        jffs2_scan_eraseblock+0x1ca4/0x3b64=0A=
        jffs2_scan_medium+0x285/0xfe0=0A=
        jffs2_do_mount_fs+0x5fb/0x1bbc=0A=
        jffs2_do_fill_super+0x245/0x6f0=0A=
        jffs2_fill_super+0x287/0x2e0=0A=
        mount_mtd_aux.isra.0+0x9a/0x144=0A=
        mount_mtd+0x222/0x2f0=0A=
        jffs2_mount+0x41/0x60=0A=
        mount_fs+0x63/0x230=0A=
        vfs_kern_mount.part.6+0x6c/0x1f4=0A=
        do_mount+0xae8/0x1940=0A=
        SyS_mount+0x105/0x1d0=0A=
INFO: Freed in jffs2_free_full_dirent+0x22/0x40 age=3D27 cpu=3D1 pid=3D915=
=0A=
        __slab_free+0x372/0x4e4=0A=
        kfree+0x1d4/0x20c=0A=
        jffs2_free_full_dirent+0x22/0x40=0A=
        jffs2_build_remove_unlinked_inode+0x17a/0x1e4=0A=
        jffs2_do_mount_fs+0x1646/0x1bbc=0A=
        jffs2_do_fill_super+0x245/0x6f0=0A=
        jffs2_fill_super+0x287/0x2e0=0A=
        mount_mtd_aux.isra.0+0x9a/0x144=0A=
        mount_mtd+0x222/0x2f0=0A=
        jffs2_mount+0x41/0x60=0A=
        mount_fs+0x63/0x230=0A=
        vfs_kern_mount.part.6+0x6c/0x1f4=0A=
        do_mount+0xae8/0x1940=0A=
        SyS_mount+0x105/0x1d0=0A=
        entry_SYSCALL_64_fastpath+0x1e/0x97=0A=
Call Trace:=0A=
 [<ffffffff815befef>] dump_stack+0x59/0x7e=0A=
 [<ffffffff812d1d65>] print_trailer+0x125/0x1b0=0A=
 [<ffffffff812d82c8>] object_err+0x34/0x40=0A=
 [<ffffffff812dadef>] kasan_report.part.1+0x21f/0x534=0A=
 [<ffffffff81132401>] ? vprintk+0x2d/0x40=0A=
 [<ffffffff815f1ee2>] ? crc32_le+0x1ce/0x260=0A=
 [<ffffffff812db41a>] kasan_report+0x26/0x30=0A=
 [<ffffffff812d9fc1>] __asan_load1+0x3d/0x50=0A=
 [<ffffffff815f1ee2>] crc32_le+0x1ce/0x260=0A=
 [<ffffffff814764ae>] ? jffs2_alloc_full_dirent+0x2a/0x40=0A=
 [<ffffffff81485cec>] jffs2_scan_eraseblock+0x1d0c/0x3b64=0A=
 [<ffffffff81488813>] ? jffs2_scan_medium+0xccf/0xfe0=0A=
 [<ffffffff81483fe0>] ? jffs2_scan_make_ino_cache+0x14c/0x14c=0A=
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50=0A=
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50=0A=
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70=0A=
 [<ffffffff812d5d90>] ? kmem_cache_alloc_trace+0x10c/0x2cc=0A=
 [<ffffffff818169fb>] ? mtd_point+0xf7/0x130=0A=
 [<ffffffff81487dc9>] jffs2_scan_medium+0x285/0xfe0=0A=
 [<ffffffff81487b44>] ? jffs2_scan_eraseblock+0x3b64/0x3b64=0A=
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50=0A=
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50=0A=
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70=0A=
 [<ffffffff812d57df>] ? __kmalloc+0x12b/0x300=0A=
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70=0A=
 [<ffffffff814a2753>] ? jffs2_sum_init+0x9f/0x240=0A=
 [<ffffffff8148b2ff>] jffs2_do_mount_fs+0x5fb/0x1bbc=0A=
 [<ffffffff8148ad04>] ? jffs2_del_noinode_dirent+0x640/0x640=0A=
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70=0A=
 [<ffffffff81127c5b>] ? __init_rwsem+0x97/0xac=0A=
 [<ffffffff81492349>] jffs2_do_fill_super+0x245/0x6f0=0A=
 [<ffffffff81493c5b>] jffs2_fill_super+0x287/0x2e0=0A=
 [<ffffffff814939d4>] ? jffs2_parse_options+0x594/0x594=0A=
 [<ffffffff81819bea>] mount_mtd_aux.isra.0+0x9a/0x144=0A=
 [<ffffffff81819eb6>] mount_mtd+0x222/0x2f0=0A=
 [<ffffffff814939d4>] ? jffs2_parse_options+0x594/0x594=0A=
 [<ffffffff81819c94>] ? mount_mtd_aux.isra.0+0x144/0x144=0A=
 [<ffffffff81258757>] ? free_pages+0x13/0x1c=0A=
 [<ffffffff814fa0ac>] ? selinux_sb_copy_data+0x278/0x2e0=0A=
 [<ffffffff81492b35>] jffs2_mount+0x41/0x60=0A=
 [<ffffffff81302fb7>] mount_fs+0x63/0x230=0A=
 [<ffffffff8133755f>] ? alloc_vfsmnt+0x32f/0x3b0=0A=
 [<ffffffff81337f2c>] vfs_kern_mount.part.6+0x6c/0x1f4=0A=
 [<ffffffff8133ceec>] do_mount+0xae8/0x1940=0A=
 [<ffffffff811b94e0>] ? audit_filter_rules.constprop.6+0x1d10/0x1d10=0A=
 [<ffffffff8133c404>] ? copy_mount_string+0x40/0x40=0A=
 [<ffffffff812cbf78>] ? alloc_pages_current+0xa4/0x1bc=0A=
 [<ffffffff81253a89>] ? __get_free_pages+0x25/0x50=0A=
 [<ffffffff81338993>] ? copy_mount_options.part.17+0x183/0x264=0A=
 [<ffffffff8133e3a9>] SyS_mount+0x105/0x1d0=0A=
 [<ffffffff8133e2a4>] ? copy_mnt_ns+0x560/0x560=0A=
 [<ffffffff810e8391>] ? msa_space_switch_handler+0x13d/0x190=0A=
 [<ffffffff81be184a>] entry_SYSCALL_64_fastpath+0x1e/0x97=0A=
 [<ffffffff810e9274>] ? msa_space_switch+0xb0/0xe0=0A=
Memory state around the buggy address:=0A=
 ffff8800842cf180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc=0A=
 ffff8800842cf200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc=0A=
>ffff8800842cf280: fc fc fc fc fc fc 00 00 00 00 01 fc fc fc fc fc=0A=
                                                 ^=0A=
 ffff8800842cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc=0A=
 ffff8800842cf380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc=0A=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A=
=0A=
Reported-by: Kunkun Xu <xukunkun1@huawei.com>=0A=
Signed-off-by: lizhe <lizhe67@huawei.com>=0A=
---=0A=
 fs/jffs2/scan.c | 2 +-=0A=
 1 file changed, 1 insertion(+), 1 deletion(-)=0A=
=0A=
diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c=0A=
index db72a9d..b676056 100644=0A=
--- a/fs/jffs2/scan.c=0A=
+++ b/fs/jffs2/scan.c=0A=
@@ -1079,7 +1079,7 @@ static int jffs2_scan_dirent_node(struct jffs2_sb_inf=
o *c, struct jffs2_eraseblo=0A=
        memcpy(&fd->name, rd->name, checkedlen);=0A=
        fd->name[checkedlen] =3D 0;=0A=
=0A=
-       crc =3D crc32(0, fd->name, rd->nsize);=0A=
+       crc =3D crc32(0, fd->name, checkedlen);=0A=
        if (crc !=3D je32_to_cpu(rd->name_crc)) {=0A=
                pr_notice("%s(): Name CRC failed on node at 0x%08x: Read 0x=
%08x, calculated 0x%08x\n",=0A=
                          __func__, ofs, je32_to_cpu(rd->name_crc), crc);=
=0A=
--=0A=
2.7.4=0A=
=0A=
=0A=
______________________________________________________=0A=
Linux MTD discussion mailing list=0A=
https://nam11.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Flists.in=
fradead.org%2Fmailman%2Flistinfo%2Flinux-mtd%2F&amp;data=3D04%7C01%7Cjoakim=
.tjernlund%40infinera.com%7C7ec1d950724f4995dc9c08d8e9bc0e35%7C285643de5f5b=
4b03a1530ae2dc8aaf77%7C1%7C1%7C637516341206870320%7CUnknown%7CTWFpbGZsb3d8e=
yJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&am=
p;sdata=3DV0RwumJqxPlGWG6qBjSfu%2FDk5lon3vjB23S2h4w0DDg%3D&amp;reserved=3D0=
=0A=