Yang Yang 5781c9df77 jffs2: check the validity of dstlen in jffs2_zlib_compress() ... commit 90ada91f4610c5ef11bc52576516d96c496fc3f1 upstream. KASAN reports a BUG when download file in jffs2 filesystem.It is because when dstlen == 1, cpage_out will write array out of bounds. Actually, data will not be compressed in jffs2_zlib_compress() if data's length less than 4. [ 393.799778] BUG: KASAN: slab-out-of-bounds in jffs2_rtime_compress+0x214/0x2f0 at addr ffff800062e3b281 [ 393.809166] Write of size 1 by task tftp/2918 [ 393.813526] CPU: 3 PID: 2918 Comm: tftp Tainted: G B 4.9.115-rt93-EMBSYS-CGEL-6.1.R6-dirty #1 [ 393.823173] Hardware name: LS1043A RDB Board (DT) [ 393.827870] Call trace: [ 393.830322] [<ffff20000808c700>] dump_backtrace+0x0/0x2f0 [ 393.835721] [<ffff20000808ca04>] show_stack+0x14/0x20 [ 393.840774] [<ffff2000086ef700>] dump_stack+0x90/0xb0 [ 393.845829] [<ffff20000827b19c>] kasan_object_err+0x24/0x80 [ 393.851402] [<ffff20000827b404>] kasan_report_error+0x1b4/0x4d8 [ 393.857323] [<ffff20000827bae8>] kasan_report+0x38/0x40 [ 393.862548] [<ffff200008279d44>] __asan_store1+0x4c/0x58 [ 393.867859] [<ffff2000084ce2ec>] jffs2_rtime_compress+0x214/0x2f0 [ 393.873955] [<ffff2000084bb3b0>] jffs2_selected_compress+0x178/0x2a0 [ 393.880308] [<ffff2000084bb530>] jffs2_compress+0x58/0x478 [ 393.885796] [<ffff2000084c5b34>] jffs2_write_inode_range+0x13c/0x450 [ 393.892150] [<ffff2000084be0b8>] jffs2_write_end+0x2a8/0x4a0 [ 393.897811] [<ffff2000081f3008>] generic_perform_write+0x1c0/0x280 [ 393.903990] [<ffff2000081f5074>] __generic_file_write_iter+0x1c4/0x228 [ 393.910517] [<ffff2000081f5210>] generic_file_write_iter+0x138/0x288 [ 393.916870] [<ffff20000829ec1c>] __vfs_write+0x1b4/0x238 [ 393.922181] [<ffff20000829ff00>] vfs_write+0xd0/0x238 [ 393.927232] [<ffff2000082a1ba8>] SyS_write+0xa0/0x110 [ 393.932283] [<ffff20000808429c>] __sys_trace_return+0x0/0x4 [ 393.937851] Object at ffff800062e3b280, in cache kmalloc-64 size: 64 [ 393.944197] Allocated: [ 393.946552] PID = 2918 [ 393.948913] save_stack_trace_tsk+0x0/0x220 [ 393.953096] save_stack_trace+0x18/0x20 [ 393.956932] kasan_kmalloc+0xd8/0x188 [ 393.960594] __kmalloc+0x144/0x238 [ 393.963994] jffs2_selected_compress+0x48/0x2a0 [ 393.968524] jffs2_compress+0x58/0x478 [ 393.972273] jffs2_write_inode_range+0x13c/0x450 [ 393.976889] jffs2_write_end+0x2a8/0x4a0 [ 393.980810] generic_perform_write+0x1c0/0x280 [ 393.985251] __generic_file_write_iter+0x1c4/0x228 [ 393.990040] generic_file_write_iter+0x138/0x288 [ 393.994655] __vfs_write+0x1b4/0x238 [ 393.998228] vfs_write+0xd0/0x238 [ 394.001543] SyS_write+0xa0/0x110 [ 394.004856] __sys_trace_return+0x0/0x4 [ 394.008684] Freed: [ 394.010691] PID = 2918 [ 394.013051] save_stack_trace_tsk+0x0/0x220 [ 394.017233] save_stack_trace+0x18/0x20 [ 394.021069] kasan_slab_free+0x88/0x188 [ 394.024902] kfree+0x6c/0x1d8 [ 394.027868] jffs2_sum_write_sumnode+0x2c4/0x880 [ 394.032486] jffs2_do_reserve_space+0x198/0x598 [ 394.037016] jffs2_reserve_space+0x3f8/0x4d8 [ 394.041286] jffs2_write_inode_range+0xf0/0x450 [ 394.045816] jffs2_write_end+0x2a8/0x4a0 [ 394.049737] generic_perform_write+0x1c0/0x280 [ 394.054179] __generic_file_write_iter+0x1c4/0x228 [ 394.058968] generic_file_write_iter+0x138/0x288 [ 394.063583] __vfs_write+0x1b4/0x238 [ 394.067157] vfs_write+0xd0/0x238 [ 394.070470] SyS_write+0xa0/0x110 [ 394.073783] __sys_trace_return+0x0/0x4 [ 394.077612] Memory state around the buggy address: [ 394.082404] ffff800062e3b180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 394.089623] ffff800062e3b200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 394.096842] >ffff800062e3b280: 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 394.104056] ^ [ 394.107283] ffff800062e3b300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 394.114502] ffff800062e3b380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 394.121718] ================================================================== Signed-off-by: Yang Yang <yang.yang29@zte.com.cn> Cc: Joel Stanley <joel@jms.id.au> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-05-11 14:47:36 +02:00
..
9p	fs: 9p: add generic splice_write file operation	2020-12-01 21:40:47 +01:00
adfs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
affs	fs/affs: release old buffer head on error path	2021-03-04 11:38:37 +01:00
afs	afs: Stop listxattr() from listing "afs.*" attributes	2021-03-25 09:04:07 +01:00
autofs
befs
bfs	bfs: don't use WARNING: string when it's just info.	2021-01-06 14:56:52 +01:00
btrfs	btrfs: fix race when picking most recent mod log operation for an old root	2021-05-11 14:47:33 +02:00
cachefiles	fs/cachefiles: Remove wait_bit_key layout dependency	2021-03-30 14:32:07 +02:00
ceph	ceph: fix flush_snap logic after putting caps	2021-03-04 11:38:08 +01:00
cifs	smb2: fix use-after-free in smb2_ioctl_query_info()	2021-05-11 14:47:15 +02:00
coda
configfs	configfs: fix a use-after-free in __configfs_open_file	2021-03-17 17:06:34 +01:00
cramfs
crypto	fscrypt: add fscrypt_is_nokey_name()	2020-12-26 16:02:43 +01:00
debugfs	debugfs: do not attempt to create a new file before the filesystem is initalized	2021-03-04 11:37:17 +01:00
devpts
dlm
ecryptfs	ecryptfs: fix kernel panic with null dev_name	2021-05-11 14:47:12 +02:00
efivarfs	efivarfs: revert "fix memory leak in efivarfs_create()"	2020-11-25 16:55:02 +01:00
efs
erofs	erofs: add unsupported inode i_format check	2021-05-11 14:47:13 +02:00
exfat	exfat: fix erroneous discard when clear cluster bit	2021-05-11 14:47:36 +02:00
exportfs
ext2	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
ext4	ext4: do not iput inode under running transaction in ext4_rename()	2021-04-07 15:00:06 +02:00
f2fs	f2fs: fix to avoid out-of-bounds memory access	2021-05-11 14:47:34 +02:00
fat
freevxfs
fscache
fuse	fuse: fix write deadlock	2021-05-11 14:47:36 +02:00
gfs2	gfs2: report "already frozen/thawed" errors	2021-04-16 11:43:20 +02:00
hfs	fs: Replace zero-length array with flexible-array member	2020-10-29 17:22:59 -05:00
hfsplus	fs: Replace zero-length array with flexible-array member	2020-10-29 17:22:59 -05:00
hostfs	hostfs: fix memory handling in follow_link()	2021-04-14 08:42:06 +02:00
hpfs
hugetlbfs	mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page	2021-02-10 09:29:20 +01:00
iomap	iomap: Fix negative assignment to unsigned sis->pages in iomap_swapfile_activate	2021-04-07 15:00:04 +02:00
isofs	isofs: release buffer head before return	2021-03-04 11:38:00 +01:00
jbd2	jbd2: fix kernel-doc markups	2020-11-19 22:38:29 -05:00
jffs2	jffs2: check the validity of dstlen in jffs2_zlib_compress()	2021-05-11 14:47:36 +02:00
jfs	JFS: more checks for invalid superblock	2021-03-07 12:34:04 +01:00
kernfs	kernfs: wire up ->splice_read and ->splice_write	2021-01-27 11:55:29 +01:00
lockd	lockd: don't use interval-based rebinding over TCP	2020-12-30 11:53:30 +01:00
minix
nfs	NFSv4: Don't discard segments marked for return in _pnfs_return_layout()	2021-05-11 14:47:34 +02:00
nfs_common	nfs_common: need lock during iterate through the list	2020-12-30 11:53:45 +01:00
nfsd	NFSD: fix error handling in NFSv4.0 callbacks	2021-04-07 15:00:05 +02:00
nilfs2	nilfs2: make splice write available again	2021-02-13 13:55:16 +01:00
nls
notify	fanotify: Fix sys_fanotify_mark() on native x86-32	2021-01-17 14:16:59 +01:00
ntfs	ntfs: check for valid standard information attribute	2021-02-26 10:13:00 +01:00
ocfs2	ocfs2: fix deadlock between setattr and dio_end_io_write	2021-04-14 08:41:58 +02:00
omfs
openpromfs
orangefs
overlayfs	ovl: allow upperdir inside lowerdir	2021-05-07 11:04:33 +02:00
proc	proc: don't allow async path resolution of /proc/thread-self components	2021-03-04 11:38:42 +01:00
pstore	pstore: Fix warning in pstore_kill_sb()	2021-03-25 09:04:08 +01:00
qnx4
qnx6
quota	quota: Fix memory leak when handling corrupted quota file	2021-03-04 11:37:53 +01:00
ramfs
reiserfs	reiserfs: update reiserfs_xattrs_initialized() condition	2021-04-07 15:00:10 +02:00
romfs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
squashfs	squashfs: fix xattr id and id lookup sanity checks	2021-03-30 14:31:54 +02:00
sysfs
sysv
tracefs
ubifs	ubifs: Only check replay with inode type to judge if inode linked	2021-05-11 14:47:33 +02:00
udf	udf: fix silent AED tagLocation corruption	2021-03-17 17:06:23 +01:00
ufs	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-10-24 12:26:05 -07:00
unicode
vboxsf
verity
xfs	xfs: Fix assert failure in xfs_setattr_size()	2021-03-07 12:34:05 +01:00
zonefs	zonefs: fix to update .i_wr_refcnt correctly in zonefs_open_zone()	2021-03-25 09:04:05 +01:00
aio.c	vfs: separate __sb_start_write into blocking and non-blocking helpers	2020-11-10 16:53:07 -08:00
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c	fs: Replace zero-length array with flexible-array member	2020-10-29 17:22:59 -05:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c	binfmt_misc: fix possible deadlock in bm_register_write	2021-03-17 17:06:35 +01:00
binfmt_script.c
block_dev.c	block: don't ignore REQ_NOWAIT for direct IO	2021-04-16 11:43:21 +02:00
buffer.c
char_dev.c
compat_binfmt_elf.c
coredump.c	coredump: fix core_pattern parse error	2020-12-06 10:19:07 -08:00
d_path.c
dax.c	mm: provide a saner PTE walking API for modules	2021-02-26 10:13:01 +01:00
dcache.c
dcookies.c
direct-io.c	fs: direct-io: fix missing sdio->boundary	2021-04-14 08:41:58 +02:00
drop_caches.c
eventfd.c
eventpoll.c	fs/epoll: restore waking from ep_done_scan()	2021-05-11 14:47:12 +02:00
exec.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:46:24 +01:00
fcntl.c	fcntl: Fix potential deadlock in send_sig{io, urg}()	2021-01-06 14:56:53 +01:00
fhandle.c
file_table.c
file.c	kernel/io_uring: cancel io_uring before task works	2021-01-30 13:55:18 +01:00
filesystems.c
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	fs: fix lazytime expiration handling in __writeback_single_inode()	2021-01-27 11:54:53 +01:00
fsopen.c
init.c
inode.c	fs: Handle I_DONTCACHE in iput_final() instead of generic_drop_inode()	2020-12-30 11:53:49 +01:00
internal.h
io_uring.c	io_uring: don't mark S_ISBLK async work as unbounded	2021-04-16 11:43:21 +02:00
io-wq.c	io_uring: always batch cancel in *cancel_files()	2021-02-13 13:54:56 +01:00
io-wq.h	io_uring: always batch cancel in *cancel_files()	2021-02-13 13:54:56 +01:00
ioctl.c
Kconfig	tmpfs: disallow CONFIG_TMPFS_INODE64 on alpha	2021-02-17 11:02:21 +01:00
Kconfig.binfmt
kernel_read_file.c
libfs.c	libfs: fix error cast of negative value in simple_attr_write()	2020-11-22 10:48:22 -08:00
locks.c	Revert "nfsd4: a client's own opens needn't prevent delegations"	2021-03-20 10:43:44 +01:00
Makefile	Refactored code for 5.10:	2020-10-23 11:33:41 -07:00
mbcache.c
mount.h
mpage.c
namei.c	LOOKUP_MOUNTPOINT: we are cleaning "jumped" flag too late	2021-04-14 08:41:58 +02:00
namespace.c	umount(2): move the flag validity checks first	2021-01-19 18:27:32 +01:00
no-block.c
nsfs.c
open.c	openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT	2020-12-30 11:54:24 +01:00
pipe.c	fs/pipe: allow sendfile() to pipe again	2021-01-27 11:55:29 +01:00
pnode.c
pnode.h	mount: fix mounting of detached mounts onto targets that reside on shared mounts	2021-03-17 17:06:13 +01:00
posix_acl.c
proc_namespace.c	proc mountinfo: make splice available again	2020-12-30 11:54:02 +01:00
read_write.c	Refactored code for 5.10:	2020-10-23 11:33:41 -07:00
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-21 13:00:54 +02:00
remap_range.c
select.c	kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()	2021-03-25 09:04:16 +01:00
seq_file.c	fix return values of seq_read_iter()	2020-11-15 22:12:53 -05:00
signalfd.c
splice.c	io_uring-5.10-2020-10-24	2020-10-24 12:40:18 -07:00
stack.c
stat.c	fs: fix reporting supported extra file attributes for statx()	2021-05-11 14:47:33 +02:00
statfs.c
super.c	vfs: move __sb_{start,end}_write* to fs.h	2020-11-10 16:53:11 -08:00
sync.c
timerfd.c
userfaultfd.c
utimes.c
xattr.c