[4.4,046/190] jffs2: check the validity of dstlen in jffs2_zlib_compress()

From: Yang Yang <yang.yang29@zte.com.cn>

From: Yang Yang <yang.yang29@zte.com.cn>

commit 90ada91f4610c5ef11bc52576516d96c496fc3f1 upstream.

KASAN reports a BUG when download file in jffs2 filesystem.It is
because when dstlen == 1, cpage_out will write array out of bounds.
Actually, data will not be compressed in jffs2_zlib_compress() if
data's length less than 4.

[  393.799778] BUG: KASAN: slab-out-of-bounds in jffs2_rtime_compress+0x214/0x2f0 at addr ffff800062e3b281
[  393.809166] Write of size 1 by task tftp/2918
[  393.813526] CPU: 3 PID: 2918 Comm: tftp Tainted: G    B           4.9.115-rt93-EMBSYS-CGEL-6.1.R6-dirty #1
[  393.823173] Hardware name: LS1043A RDB Board (DT)
[  393.827870] Call trace:
[  393.830322] [<ffff20000808c700>] dump_backtrace+0x0/0x2f0
[  393.835721] [<ffff20000808ca04>] show_stack+0x14/0x20
[  393.840774] [<ffff2000086ef700>] dump_stack+0x90/0xb0
[  393.845829] [<ffff20000827b19c>] kasan_object_err+0x24/0x80
[  393.851402] [<ffff20000827b404>] kasan_report_error+0x1b4/0x4d8
[  393.857323] [<ffff20000827bae8>] kasan_report+0x38/0x40
[  393.862548] [<ffff200008279d44>] __asan_store1+0x4c/0x58
[  393.867859] [<ffff2000084ce2ec>] jffs2_rtime_compress+0x214/0x2f0
[  393.873955] [<ffff2000084bb3b0>] jffs2_selected_compress+0x178/0x2a0
[  393.880308] [<ffff2000084bb530>] jffs2_compress+0x58/0x478
[  393.885796] [<ffff2000084c5b34>] jffs2_write_inode_range+0x13c/0x450
[  393.892150] [<ffff2000084be0b8>] jffs2_write_end+0x2a8/0x4a0
[  393.897811] [<ffff2000081f3008>] generic_perform_write+0x1c0/0x280
[  393.903990] [<ffff2000081f5074>] __generic_file_write_iter+0x1c4/0x228
[  393.910517] [<ffff2000081f5210>] generic_file_write_iter+0x138/0x288
[  393.916870] [<ffff20000829ec1c>] __vfs_write+0x1b4/0x238
[  393.922181] [<ffff20000829ff00>] vfs_write+0xd0/0x238
[  393.927232] [<ffff2000082a1ba8>] SyS_write+0xa0/0x110
[  393.932283] [<ffff20000808429c>] __sys_trace_return+0x0/0x4
[  393.937851] Object at ffff800062e3b280, in cache kmalloc-64 size: 64
[  393.944197] Allocated:
[  393.946552] PID = 2918
[  393.948913]  save_stack_trace_tsk+0x0/0x220
[  393.953096]  save_stack_trace+0x18/0x20
[  393.956932]  kasan_kmalloc+0xd8/0x188
[  393.960594]  __kmalloc+0x144/0x238
[  393.963994]  jffs2_selected_compress+0x48/0x2a0
[  393.968524]  jffs2_compress+0x58/0x478
[  393.972273]  jffs2_write_inode_range+0x13c/0x450
[  393.976889]  jffs2_write_end+0x2a8/0x4a0
[  393.980810]  generic_perform_write+0x1c0/0x280
[  393.985251]  __generic_file_write_iter+0x1c4/0x228
[  393.990040]  generic_file_write_iter+0x138/0x288
[  393.994655]  __vfs_write+0x1b4/0x238
[  393.998228]  vfs_write+0xd0/0x238
[  394.001543]  SyS_write+0xa0/0x110
[  394.004856]  __sys_trace_return+0x0/0x4
[  394.008684] Freed:
[  394.010691] PID = 2918
[  394.013051]  save_stack_trace_tsk+0x0/0x220
[  394.017233]  save_stack_trace+0x18/0x20
[  394.021069]  kasan_slab_free+0x88/0x188
[  394.024902]  kfree+0x6c/0x1d8
[  394.027868]  jffs2_sum_write_sumnode+0x2c4/0x880
[  394.032486]  jffs2_do_reserve_space+0x198/0x598
[  394.037016]  jffs2_reserve_space+0x3f8/0x4d8
[  394.041286]  jffs2_write_inode_range+0xf0/0x450
[  394.045816]  jffs2_write_end+0x2a8/0x4a0
[  394.049737]  generic_perform_write+0x1c0/0x280
[  394.054179]  __generic_file_write_iter+0x1c4/0x228
[  394.058968]  generic_file_write_iter+0x138/0x288
[  394.063583]  __vfs_write+0x1b4/0x238
[  394.067157]  vfs_write+0xd0/0x238
[  394.070470]  SyS_write+0xa0/0x110
[  394.073783]  __sys_trace_return+0x0/0x4
[  394.077612] Memory state around the buggy address:
[  394.082404]  ffff800062e3b180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[  394.089623]  ffff800062e3b200: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[  394.096842] >ffff800062e3b280: 01 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  394.104056]                    ^
[  394.107283]  ffff800062e3b300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[  394.114502]  ffff800062e3b380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[  394.121718] ==================================================================

Signed-off-by: Yang Yang <yang.yang29@zte.com.cn>
Cc: Joel Stanley <joel@jms.id.au>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/jffs2/compr_rtime.c |    3 +++
 1 file changed, 3 insertions(+)

Message ID	20210520092103.697291361@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Yang Yang <yang.yang29@zte.com.cn>, Joel Stanley <joel@jms.id.au>, Richard Weinberger <richard@nod.at> Subject: [PATCH 4.4 046/190] jffs2: check the validity of dstlen in jffs2_zlib_compress() Date: Thu, 20 May 2021 11:21:50 +0200 Message-Id: <20210520092103.697291361@linuxfoundation.org> In-Reply-To: <20210520092102.149300807@linuxfoundation.org> References: <20210520092102.149300807@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.4,002/190] net: usb: ax88179_178a: initialize local variables before use [4.4,003/190] iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd() [4.4,004/190] ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX [4.4,005/190] USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet [4.4,006/190] USB: Add reset-resume quirk for WD19s Realtek Hub [4.4,007/190] platform/x86: thinkpad_acpi: Correct thermal sensor allocation [4.4,008/190] s390/disassembler: increase ebpf disasm buffer size [4.4,009/190] ACPI: custom_method: fix potential use-after-free issue [4.4,010/190] ACPI: custom_method: fix a possible memory leak [4.4,011/190] ecryptfs: fix kernel panic with null dev_name [4.4,012/190] mmc: core: Do a power cycle when the CMD11 fails [4.4,013/190] mmc: core: Set read only for SD cards with permanent write protect bit [4.4,014/190] fbdev: zero-fill colormap in fbcmap.c [4.4,015/190] staging: wimax/i2400m: fix byte-order issue [4.4,016/190] usb: gadget: uvc: add bInterval checking for HS mode [4.4,017/190] PCI: PM: Do not read power state in pci_enable_device_flags() [4.4,018/190] x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) [4.4,019/190] spi: dln2: Fix reference leak to master [4.4,020/190] spi: omap-100k: Fix reference leak to master [4.4,021/190] intel_th: Consistency and off-by-one fix [4.4,022/190] phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() [4.4,023/190] btrfs: convert logic BUG_ON()s in replace_path to ASSERT()s [4.4,024/190] scsi: target: pscsi: Fix warning in pscsi_complete_cmd() [4.4,025/190] media: ite-cir: check for receive overflow [4.4,026/190] media: media/saa7164: fix saa7164_encoder_register() memory leak bugs [4.4,027/190] media: gspca/sq905.c: fix uninitialized variable [4.4,028/190] media: em28xx: fix memory leak [4.4,029/190] clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return [4.4,030/190] power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() [4.4,031/190] power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() [4.4,032/190] media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() [4.4,033/190] media: dvb-usb: fix memory leak in dvb_usb_adapter_init [4.4,034/190] media: gscpa/stv06xx: fix memory leak [4.4,035/190] drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal [4.4,036/190] drm/amdgpu: fix NULL pointer dereference [4.4,037/190] scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response [4.4,038/190] scsi: libfc: Fix a format specifier [4.4,039/190] ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer [4.4,040/190] ALSA: sb: Fix two use after free in snd_sb_qsound_build [4.4,041/190] arm64/vdso: Discard .note.gnu.property sections in vDSO [4.4,042/190] openvswitch: fix stack OOB read while fragmenting IPv4 packets [4.4,043/190] jffs2: Fix kasan slab-out-of-bounds problem [4.4,044/190] powerpc/eeh: Fix EEH handling for hugepages in ioremap space. [4.4,045/190] powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h [4.4,046/190] jffs2: check the validity of dstlen in jffs2_zlib_compress() [4.4,047/190] ftrace: Handle commands when closing set_ftrace_filter file [4.4,048/190] ext4: fix check to prevent false positive report of incorrect used inodes [4.4,049/190] ext4: fix error code in ext4_commit_super [4.4,050/190] usb: gadget: dummy_hcd: fix gpf in gadget_setup [4.4,051/190] usb: gadget/function/f_fs string table fix for multiple languages [4.4,052/190] dm persistent data: packed struct should have an aligned() attribute too [4.4,053/190] dm space map common: fix division bug in sm_ll_find_free_block() [4.4,054/190] Bluetooth: verify AMP hci_chan before amp_destroy [4.4,055/190] hsr: use netdev_err() instead of WARN_ONCE() [4.4,056/190] net/nfc: fix use-after-free llcp_sock_bind/connect [4.4,057/190] FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR [4.4,058/190] misc: lis3lv02d: Fix false-positive WARN on various HP models [4.4,059/190] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct [4.4,060/190] misc: vmw_vmci: explicitly initialize vmci_datagram payload [4.4,061/190] tracing: Use strlcpy() instead of strcpy() in __trace_find_cmdline() [4.4,062/190] tracing: Treat recording comm for idle task as a success [4.4,063/190] tracing: Map all PIDs to command lines [4.4,064/190] tracing: Restructure trace_clock_global() to never block [4.4,065/190] md: factor out a mddev_find_locked helper from mddev_find [4.4,066/190] md: md_open returns -EBUSY when entering racing area [4.4,067/190] ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() [4.4,068/190] cfg80211: scan: drop entry from hidden_list on overflow [4.4,069/190] drm/radeon: fix copy of uninitialized variable back to userspace [4.4,070/190] ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries [4.4,071/190] ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries [4.4,072/190] ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries [4.4,073/190] ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices [4.4,074/190] KVM: s390: split kvm_s390_real_to_abs [4.4,075/190] usb: gadget: pch_udc: Revert d3cb25a12138 completely [4.4,076/190] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] [4.4,077/190] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 [4.4,078/190] ARM: dts: exynos: correct PMIC interrupt trigger level on Snow [4.4,079/190] usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() [4.4,080/190] usb: gadget: pch_udc: Check if driver is present before calling ->setup() [4.4,081/190] usb: gadget: pch_udc: Check for DMA mapping error [4.4,082/190] crypto: qat - dont release uninitialized resources [4.4,083/190] fotg210-udc: Fix DMA on EP0 for length > max packet size [4.4,084/190] fotg210-udc: Fix EP0 IN requests bigger than two packets [4.4,085/190] fotg210-udc: Remove a dubious condition leading to fotg210_done [4.4,086/190] fotg210-udc: Mask GRP2 interrupts we dont handle [4.4,087/190] fotg210-udc: Dont DMA more than the buffer can take [4.4,088/190] fotg210-udc: Complete OUT requests on short packets [4.4,089/190] mtd: require write permissions for locking and badblock ioctls [4.4,090/190] crypto: qat - fix error path in adf_isr_resource_alloc() [4.4,091/190] staging: rtl8192u: Fix potential infinite loop [4.4,092/190] crypto: qat - Fix a double free in adf_create_ring [4.4,093/190] usb: gadget: r8a66597: Add missing null check on return from platform_get_resource [4.4,094/190] USB: cdc-acm: fix unprivileged TIOCCSERIAL [4.4,095/190] tty: fix return value for unsupported ioctls [4.4,096/190] ttyprintk: Add TTY hangup callback. [4.4,097/190] media: vivid: fix assignment of dev->fbuf_out_flags [4.4,098/190] media: omap4iss: return error code when omap4iss_get() failed [4.4,099/190] media: m88rs6000t: avoid potential out-of-bounds reads on arrays [4.4,100/190] pata_arasan_cf: fix IRQ check [4.4,101/190] pata_ipx4xx_cf: fix IRQ check [4.4,102/190] sata_mv: add IRQ checks [4.4,103/190] ata: libahci_platform: fix IRQ check [4.4,104/190] scsi: fcoe: Fix mismatched fcoe_wwn_from_mac declaration [4.4,105/190] media: dvb-usb-remote: fix dvb_usb_nec_rc_key_to_event type mismatch [4.4,106/190] scsi: jazz_esp: Add IRQ check [4.4,107/190] scsi: sun3x_esp: Add IRQ check [4.4,108/190] scsi: sni_53c710: Add IRQ check [4.4,109/190] HSI: core: fix resource leaks in hsi_add_client_from_dt() [4.4,110/190] x86/events/amd/iommu: Fix sysfs type mismatch [4.4,111/190] HID: plantronics: Workaround for double volume key presses [4.4,112/190] net: lapbether: Prevent racing when checking whether the netif is running [4.4,113/190] powerpc/prom: Mark identical_pvr_fixup as __init [4.4,114/190] ALSA: core: remove redundant spin_lock pair in snd_card_disconnect [4.4,115/190] nfc: pn533: prevent potential memory corruption [4.4,116/190] ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls [4.4,117/190] powerpc: iommu: fix build when neither PCI or IBMVIO is set [4.4,118/190] mac80211: bail out if cipher schemes are invalid [4.4,119/190] mt7601u: fix always true expression [4.4,120/190] net: thunderx: Fix unintentional sign extension issue [4.4,121/190] i2c: cadence: add IRQ check [4.4,122/190] i2c: jz4780: add IRQ check [4.4,123/190] i2c: sh7760: add IRQ check [4.4,124/190] powerpc/pseries: extract host bridge from pci_bus prior to bus removal [4.4,125/190] i2c: sh7760: fix IRQ error path [4.4,126/190] mwl8k: Fix a double Free in mwl8k_probe_hw [4.4,127/190] vsock/vmci: log once the failed queue pair allocation [4.4,128/190] net: davinci_emac: Fix incorrect masking of tx and rx error channel [4.4,129/190] ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices [4.4,130/190] powerpc/52xx: Fix an invalid ASM expression (addi used instead of add) [4.4,131/190] net:nfc:digital: Fix a double free in digital_tg_recv_dep_req [4.4,132/190] kfifo: fix ternary sign extension bugs [4.4,133/190] Revert "net/sctp: fix race condition in sctp_destroy_sock" [4.4,134/190] sctp: delay auto_asconf init until binding the first addr [4.4,135/190] fs: dlm: fix debugfs dump [4.4,136/190] tipc: convert dest nodes address to network order [4.4,137/190] net: stmmac: Set FIFO sizes for ipq806x [4.4,138/190] ALSA: hdsp: dont disable if not enabled [4.4,139/190] ALSA: hdspm: dont disable if not enabled [4.4,140/190] ALSA: rme9652: dont disable if not enabled [4.4,141/190] Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default [4.4,142/190] Bluetooth: initialize skb_queue_head at l2cap_chan_create() [4.4,143/190] ip6_vti: proper dev_{hold\|put} in ndo_[un]init methods [4.4,144/190] mac80211: clear the beacons CRC after channel switch [4.4,145/190] cuse: prevent clone [4.4,146/190] selftests: Set CC to clang in lib.mk if LLVM is set [4.4,147/190] kconfig: nconf: stop endless search loops [4.4,148/190] sctp: Fix out-of-bounds warning in sctp_process_asconf_param() [4.4,149/190] ASoC: rt286: Generalize support for ALC3263 codec [4.4,150/190] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt [4.4,151/190] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join [4.4,152/190] powerpc/iommu: Annotate nested lock for lockdep [4.4,153/190] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable [4.4,154/190] PCI: Release OF node in pci_scan_device()s error path [4.4,155/190] NFS: Deal correctly with attribute generation counter overflow [4.4,156/190] pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() [4.4,157/190] NFSv4.2 fix handling of sr_eof in SEEKs reply [4.4,158/190] sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b [4.4,159/190] drm/radeon: Fix off-by-one power_state index heap overwrite [4.4,160/190] ksm: fix potential missing rmap_item for stable_node [4.4,161/190] kernel: kexec_file: fix error return code of kexec_calculate_store_digests() [4.4,162/190] ARC: entry: fix off-by-one error in syscall number validation [4.4,163/190] powerpc/64s: Fix crashes when toggling entry flush barrier [4.4,164/190] squashfs: fix divide error in calculate_skip() [4.4,165/190] usb: fotg210-hcd: Fix an error message [4.4,166/190] usb: xhci: Increase timeout for HC halt [4.4,167/190] usb: dwc2: Fix gadget DMA unmap direction [4.4,168/190] usb: core: hub: fix race condition about TRSMRCY of resume [4.4,169/190] KVM: x86: Cancel pvclock_gtod_work on module removal [4.4,170/190] FDDI: defxx: Make MMIO the configuration default except for EISA [4.4,171/190] MIPS: Reinstate platform `__div64_32 handler [4.4,172/190] MIPS: Avoid DIVU in `__div64_32 is result would be zero [4.4,173/190] MIPS: Avoid handcoded DIVU in `__div64_32 altogether [4.4,174/190] thermal/core/fair share: Lock the thermal zone while looping over instances [4.4,175/190] dm ioctl: fix out of bounds array access when no devices [4.4,176/190] kobject_uevent: remove warning in init_uevent_argv() [4.4,177/190] x86/msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes [4.4,178/190] kgdb: fix gcc-11 warning on indentation [4.4,179/190] usb: sl811-hcd: improve misleading indentation [4.4,180/190] cxgb4: Fix the -Wmisleading-indentation warning [4.4,181/190] isdn: capi: fix mismatched prototypes [4.4,182/190] ARM: 9058/1: cache-v7: refactor v7_invalidate_l1 to avoid clobbering r5/r6 [4.4,183/190] ACPI / hotplug / PCI: Fix reference count leak in enable_slot() [4.4,184/190] um: Mark all kernel symbols as local [4.4,185/190] ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP [4.4,186/190] sit: proper dev_{hold\|put} in ndo_[un]init methods [4.4,187/190] ip6_tunnel: sit: proper dev_{hold\|put} in ndo_[un]init methods [4.4,188/190] ipv6: remove extra dev_hold() for fallback tunnels [4.4,189/190] xhci: Do not use GFP_KERNEL in (potentially) atomic context [4.4,190/190] iio: tsl2583: Fix division by a zero lux_val

[4.4,046/190] jffs2: check the validity of dstlen in jffs2_zlib_compress()

Commit Message

Patch