Received: by 2002:a05:6a10:206:0:0:0:0 with SMTP id 6csp2503474pxj; Mon, 10 May 2021 04:42:14 -0700 (PDT) X-Google-Smtp-Source: ABdhPJygHQXlvyv/G3sZwdUdIcvEx1GmpFb4aDvNFPU5egeEgPgDyqOvMrVGzkrxHU+KWrSXhpV0 X-Received: by 2002:a05:6402:6cd:: with SMTP id n13mr29708746edy.330.1620646934085; Mon, 10 May 2021 04:42:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1620646934; cv=none; d=google.com; s=arc-20160816; b=rxH/uBJFkwjq/tKIMCxCNTY9/fBpSVfp2PEng5uSNtFs2+Ubk+FmTHL4JbrCEMgb8p yj9UesSqqLHzYT4S1oV3ioR9BWTUUhBHqBTkpmzRS+Dki32CzARMdvEgczzCTZyZaOLT gjFB6O1GayboZa0UzOiS37ihc6uA6Lph85ZngX3WO3CcMu4uogp64gZs9DvCqzGZaztT pcexG+sOaOJHuBuSPoTiKLjYFu3tDQ5XwFtmFGHHInjnSDRlFcW6xLR+F4ivuiU3c5z1 ctnfIN1g274eY7rywRrn1zNh7J8sk0ObkTOgLlEwEaV13/3BlCkHcHibtEnaZAtCXDmw 8Qpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=F2/LiqymSrFMIHsqosWA3/XPBIKLkolTBr1w828nWUc=; b=bcdnsaL8T9ZNqe1ew1u/IxnpZGK+tg/ABLaKW5pfP9I34tdkmYnoesraqnIXsH2qGl 59O5Pd/7lfRWJKEXHn1bpJewH9ONsqtYIZQLk6zKxlleHG/OTKo3iuEFWrK18tkN2N5n cm6UQpnbS+7ComNwcNpRgB3sJkTRVfGTqFaHbGbdWEIjFrOnFUwkHyV7S3bNlnouAVUP qyfJfA7/mlc+/azgSI3VdWA2kmgWH6HcjS6EjLNgC2i9e9y1In/gU2KkJb1/XG7PDxr0 yOBApTqbi/WgzyT+0mWs80rRx90tk6X7Lc0dlCaB2XC6U5Y14rpEevL97bhgrnlNJ5AK 9stA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=aWVnvjjW; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id gy9si12646381ejb.426.2021.05.10.04.41.50; Mon, 10 May 2021 04:42:14 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=aWVnvjjW; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240900AbhEJLg5 (ORCPT + 99 others); Mon, 10 May 2021 07:36:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:46292 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232349AbhEJKxt (ORCPT ); Mon, 10 May 2021 06:53:49 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 88330613C9; Mon, 10 May 2021 10:41:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1620643295; bh=gl4LTxeDSpZKZS21MVfhx8fcKg+TJblp7rcu6FDOc1M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aWVnvjjWJDfvfvvhlDRHAj9mkcUYRU/0xbqGnzlrTmftXke2i7t+0w9Jwr+kiokja 9wLmdY6kc+rIp1ex7m7BGgnAsO5mig9FM9Z3HrgSIO/Qce7b8UWtuRSlvmwUSBLTHO 7wfqX4hJlHSsKi4RW3iNNOStyUUfHAJIutMar4P4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Yang , Joel Stanley , Richard Weinberger Subject: [PATCH 5.10 257/299] jffs2: check the validity of dstlen in jffs2_zlib_compress() Date: Mon, 10 May 2021 12:20:54 +0200 Message-Id: <20210510102013.440312793@linuxfoundation.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210510102004.821838356@linuxfoundation.org> References: <20210510102004.821838356@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Yang Yang commit 90ada91f4610c5ef11bc52576516d96c496fc3f1 upstream. KASAN reports a BUG when download file in jffs2 filesystem.It is because when dstlen == 1, cpage_out will write array out of bounds. Actually, data will not be compressed in jffs2_zlib_compress() if data's length less than 4. [ 393.799778] BUG: KASAN: slab-out-of-bounds in jffs2_rtime_compress+0x214/0x2f0 at addr ffff800062e3b281 [ 393.809166] Write of size 1 by task tftp/2918 [ 393.813526] CPU: 3 PID: 2918 Comm: tftp Tainted: G B 4.9.115-rt93-EMBSYS-CGEL-6.1.R6-dirty #1 [ 393.823173] Hardware name: LS1043A RDB Board (DT) [ 393.827870] Call trace: [ 393.830322] [] dump_backtrace+0x0/0x2f0 [ 393.835721] [] show_stack+0x14/0x20 [ 393.840774] [] dump_stack+0x90/0xb0 [ 393.845829] [] kasan_object_err+0x24/0x80 [ 393.851402] [] kasan_report_error+0x1b4/0x4d8 [ 393.857323] [] kasan_report+0x38/0x40 [ 393.862548] [] __asan_store1+0x4c/0x58 [ 393.867859] [] jffs2_rtime_compress+0x214/0x2f0 [ 393.873955] [] jffs2_selected_compress+0x178/0x2a0 [ 393.880308] [] jffs2_compress+0x58/0x478 [ 393.885796] [] jffs2_write_inode_range+0x13c/0x450 [ 393.892150] [] jffs2_write_end+0x2a8/0x4a0 [ 393.897811] [] generic_perform_write+0x1c0/0x280 [ 393.903990] [] __generic_file_write_iter+0x1c4/0x228 [ 393.910517] [] generic_file_write_iter+0x138/0x288 [ 393.916870] [] __vfs_write+0x1b4/0x238 [ 393.922181] [] vfs_write+0xd0/0x238 [ 393.927232] [] SyS_write+0xa0/0x110 [ 393.932283] [] __sys_trace_return+0x0/0x4 [ 393.937851] Object at ffff800062e3b280, in cache kmalloc-64 size: 64 [ 393.944197] Allocated: [ 393.946552] PID = 2918 [ 393.948913] save_stack_trace_tsk+0x0/0x220 [ 393.953096] save_stack_trace+0x18/0x20 [ 393.956932] kasan_kmalloc+0xd8/0x188 [ 393.960594] __kmalloc+0x144/0x238 [ 393.963994] jffs2_selected_compress+0x48/0x2a0 [ 393.968524] jffs2_compress+0x58/0x478 [ 393.972273] jffs2_write_inode_range+0x13c/0x450 [ 393.976889] jffs2_write_end+0x2a8/0x4a0 [ 393.980810] generic_perform_write+0x1c0/0x280 [ 393.985251] __generic_file_write_iter+0x1c4/0x228 [ 393.990040] generic_file_write_iter+0x138/0x288 [ 393.994655] __vfs_write+0x1b4/0x238 [ 393.998228] vfs_write+0xd0/0x238 [ 394.001543] SyS_write+0xa0/0x110 [ 394.004856] __sys_trace_return+0x0/0x4 [ 394.008684] Freed: [ 394.010691] PID = 2918 [ 394.013051] save_stack_trace_tsk+0x0/0x220 [ 394.017233] save_stack_trace+0x18/0x20 [ 394.021069] kasan_slab_free+0x88/0x188 [ 394.024902] kfree+0x6c/0x1d8 [ 394.027868] jffs2_sum_write_sumnode+0x2c4/0x880 [ 394.032486] jffs2_do_reserve_space+0x198/0x598 [ 394.037016] jffs2_reserve_space+0x3f8/0x4d8 [ 394.041286] jffs2_write_inode_range+0xf0/0x450 [ 394.045816] jffs2_write_end+0x2a8/0x4a0 [ 394.049737] generic_perform_write+0x1c0/0x280 [ 394.054179] __generic_file_write_iter+0x1c4/0x228 [ 394.058968] generic_file_write_iter+0x138/0x288 [ 394.063583] __vfs_write+0x1b4/0x238 [ 394.067157] vfs_write+0xd0/0x238 [ 394.070470] SyS_write+0xa0/0x110 [ 394.073783] __sys_trace_return+0x0/0x4 [ 394.077612] Memory state around the buggy address: [ 394.082404] ffff800062e3b180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 394.089623] ffff800062e3b200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 394.096842] >ffff800062e3b280: 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 394.104056] ^ [ 394.107283] ffff800062e3b300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 394.114502] ffff800062e3b380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 394.121718] ================================================================== Signed-off-by: Yang Yang Cc: Joel Stanley Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman --- fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/jffs2/compr_rtime.c +++ b/fs/jffs2/compr_rtime.c @@ -37,6 +37,9 @@ static int jffs2_rtime_compress(unsigned int outpos = 0; int pos=0; + if (*dstlen <= 3) + return -1; + memset(positions,0,sizeof(positions)); while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {