[4.9,053/240] jffs2: Fix kasan slab-out-of-bounds problem

Message ID	20210520092110.453629484@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Kunkun Xu <xukunkun1@huawei.com>, lizhe <lizhe67@huawei.com>, Richard Weinberger <richard@nod.at> Subject: [PATCH 4.9 053/240] jffs2: Fix kasan slab-out-of-bounds problem Date: Thu, 20 May 2021 11:20:45 +0200 Message-Id: <20210520092110.453629484@linuxfoundation.org> In-Reply-To: <20210520092108.587553970@linuxfoundation.org> References: <20210520092108.587553970@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.9,002/240] iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd() [4.9,003/240] ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX [4.9,004/240] USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet [4.9,005/240] USB: Add reset-resume quirk for WD19s Realtek Hub [4.9,006/240] platform/x86: thinkpad_acpi: Correct thermal sensor allocation [4.9,007/240] s390/disassembler: increase ebpf disasm buffer size [4.9,008/240] ACPI: custom_method: fix potential use-after-free issue [4.9,009/240] ACPI: custom_method: fix a possible memory leak [4.9,010/240] arm64: dts: mt8173: fix property typo of phys in dsi node [4.9,011/240] ecryptfs: fix kernel panic with null dev_name [4.9,012/240] mmc: core: Do a power cycle when the CMD11 fails [4.9,013/240] mmc: core: Set read only for SD cards with permanent write protect bit [4.9,014/240] btrfs: fix metadata extent leak after failure to create subvolume [4.9,015/240] fbdev: zero-fill colormap in fbcmap.c [4.9,016/240] staging: wimax/i2400m: fix byte-order issue [4.9,017/240] usb: gadget: uvc: add bInterval checking for HS mode [4.9,018/240] usb: dwc3: gadget: Ignore EP queue requests during bus reset [4.9,019/240] usb: xhci: Fix port minor revision [4.9,020/240] PCI: PM: Do not read power state in pci_enable_device_flags() [4.9,021/240] x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) [4.9,022/240] spi: dln2: Fix reference leak to master [4.9,023/240] spi: omap-100k: Fix reference leak to master [4.9,024/240] intel_th: Consistency and off-by-one fix [4.9,025/240] phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() [4.9,026/240] btrfs: convert logic BUG_ON()s in replace_path to ASSERT()s [4.9,027/240] scsi: target: pscsi: Fix warning in pscsi_complete_cmd() [4.9,028/240] media: ite-cir: check for receive overflow [4.9,029/240] extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplu... [4.9,030/240] media: media/saa7164: fix saa7164_encoder_register() memory leak bugs [4.9,031/240] media: gspca/sq905.c: fix uninitialized variable [4.9,032/240] power: supply: Use IRQF_ONESHOT [4.9,033/240] scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() [4.9,034/240] scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() [4.9,035/240] media: em28xx: fix memory leak [4.9,036/240] clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return [4.9,037/240] power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() [4.9,038/240] power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() [4.9,039/240] media: adv7604: fix possible use-after-free in adv76xx_remove() [4.9,040/240] media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() [4.9,041/240] media: i2c: adv7842: fix possible use-after-free in adv7842_remove() [4.9,042/240] media: dvb-usb: fix memory leak in dvb_usb_adapter_init [4.9,043/240] media: gscpa/stv06xx: fix memory leak [4.9,044/240] drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal [4.9,045/240] drm/amdgpu: fix NULL pointer dereference [4.9,046/240] scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response [4.9,047/240] scsi: libfc: Fix a format specifier [4.9,048/240] ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer [4.9,049/240] ALSA: sb: Fix two use after free in snd_sb_qsound_build [4.9,050/240] arm64/vdso: Discard .note.gnu.property sections in vDSO [4.9,051/240] openvswitch: fix stack OOB read while fragmenting IPv4 packets [4.9,052/240] NFSv4: Dont discard segments marked for return in _pnfs_return_layout() [4.9,053/240] jffs2: Fix kasan slab-out-of-bounds problem [4.9,054/240] powerpc/eeh: Fix EEH handling for hugepages in ioremap space. [4.9,055/240] powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h [4.9,056/240] jffs2: check the validity of dstlen in jffs2_zlib_compress() [4.9,057/240] Revert 337f13046ff0 ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op") [4.9,058/240] ftrace: Handle commands when closing set_ftrace_filter file [4.9,059/240] ext4: fix check to prevent false positive report of incorrect used inodes [4.9,060/240] ext4: fix error code in ext4_commit_super [4.9,061/240] media: dvbdev: Fix memory leak in dvb_media_device_free() [4.9,062/240] usb: gadget: dummy_hcd: fix gpf in gadget_setup [4.9,063/240] usb: gadget: Fix double free of device descriptor pointers [4.9,064/240] usb: gadget/function/f_fs string table fix for multiple languages [4.9,065/240] dm persistent data: packed struct should have an aligned() attribute too [4.9,066/240] dm space map common: fix division bug in sm_ll_find_free_block() [4.9,067/240] dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails [4.9,068/240] Bluetooth: verify AMP hci_chan before amp_destroy [4.9,069/240] hsr: use netdev_err() instead of WARN_ONCE() [4.9,070/240] bluetooth: eliminate the potential race condition when removing the HCI controller [4.9,071/240] net/nfc: fix use-after-free llcp_sock_bind/connect [4.9,072/240] FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR [4.9,073/240] misc: lis3lv02d: Fix false-positive WARN on various HP models [4.9,074/240] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct [4.9,075/240] misc: vmw_vmci: explicitly initialize vmci_datagram payload [4.9,076/240] tracing: Treat recording comm for idle task as a success [4.9,077/240] tracing: Use strlcpy() instead of strcpy() in __trace_find_cmdline() [4.9,078/240] tracing: Map all PIDs to command lines [4.9,079/240] tracing: Restructure trace_clock_global() to never block [4.9,080/240] md-cluster: fix use-after-free issue when removing rdev [4.9,081/240] md: factor out a mddev_find_locked helper from mddev_find [4.9,082/240] md: md_open returns -EBUSY when entering racing area [4.9,083/240] ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() [4.9,084/240] cfg80211: scan: drop entry from hidden_list on overflow [4.9,085/240] drm/radeon: fix copy of uninitialized variable back to userspace [4.9,086/240] ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries [4.9,087/240] ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries [4.9,088/240] ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries [4.9,089/240] ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries [4.9,090/240] ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices [4.9,091/240] usb: gadget: pch_udc: Revert d3cb25a12138 completely [4.9,092/240] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] [4.9,093/240] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 [4.9,094/240] ARM: dts: exynos: correct PMIC interrupt trigger level on Snow [4.9,095/240] serial: stm32: fix incorrect characters on console [4.9,096/240] usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() [4.9,097/240] usb: gadget: pch_udc: Check if driver is present before calling ->setup() [4.9,098/240] usb: gadget: pch_udc: Check for DMA mapping error [4.9,099/240] crypto: qat - dont release uninitialized resources [4.9,100/240] crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init [4.9,101/240] fotg210-udc: Fix DMA on EP0 for length > max packet size [4.9,102/240] fotg210-udc: Fix EP0 IN requests bigger than two packets [4.9,103/240] fotg210-udc: Remove a dubious condition leading to fotg210_done [4.9,104/240] fotg210-udc: Mask GRP2 interrupts we dont handle [4.9,105/240] fotg210-udc: Dont DMA more than the buffer can take [4.9,106/240] fotg210-udc: Complete OUT requests on short packets [4.9,107/240] mtd: require write permissions for locking and badblock ioctls [4.9,108/240] bus: qcom: Put child node before return [4.9,109/240] crypto: qat - fix error path in adf_isr_resource_alloc() [4.9,110/240] mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init [4.9,111/240] staging: rtl8192u: Fix potential infinite loop [4.9,112/240] staging: greybus: uart: fix unprivileged TIOCCSERIAL [4.9,113/240] crypto: qat - Fix a double free in adf_create_ring [4.9,114/240] usb: gadget: r8a66597: Add missing null check on return from platform_get_resource [4.9,115/240] USB: cdc-acm: fix unprivileged TIOCCSERIAL [4.9,116/240] tty: actually undefine superseded ASYNC flags [4.9,117/240] tty: fix return value for unsupported ioctls [4.9,118/240] firmware: qcom-scm: Fix QCOM_SCM configuration [4.9,119/240] x86/platform/uv: Fix !KEXEC build failure [4.9,120/240] Drivers: hv: vmbus: Increase wait time for VMbus unload [4.9,121/240] ttyprintk: Add TTY hangup callback. [4.9,122/240] media: vivid: fix assignment of dev->fbuf_out_flags [4.9,123/240] media: omap4iss: return error code when omap4iss_get() failed [4.9,124/240] media: m88rs6000t: avoid potential out-of-bounds reads on arrays [4.9,125/240] pata_arasan_cf: fix IRQ check [4.9,126/240] pata_ipx4xx_cf: fix IRQ check [4.9,127/240] sata_mv: add IRQ checks [4.9,128/240] ata: libahci_platform: fix IRQ check [4.9,129/240] scsi: fcoe: Fix mismatched fcoe_wwn_from_mac declaration [4.9,130/240] media: dvb-usb-remote: fix dvb_usb_nec_rc_key_to_event type mismatch [4.9,131/240] clk: uniphier: Fix potential infinite loop [4.9,132/240] scsi: jazz_esp: Add IRQ check [4.9,133/240] scsi: sun3x_esp: Add IRQ check [4.9,134/240] scsi: sni_53c710: Add IRQ check [4.9,135/240] HSI: core: fix resource leaks in hsi_add_client_from_dt() [4.9,136/240] x86/events/amd/iommu: Fix sysfs type mismatch [4.9,137/240] HID: plantronics: Workaround for double volume key presses [4.9,138/240] perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars [4.9,139/240] net: lapbether: Prevent racing when checking whether the netif is running [4.9,140/240] powerpc/prom: Mark identical_pvr_fixup as __init [4.9,141/240] ALSA: core: remove redundant spin_lock pair in snd_card_disconnect [4.9,142/240] nfc: pn533: prevent potential memory corruption [4.9,143/240] ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls [4.9,144/240] liquidio: Fix unintented sign extension of a left shift of a u16 [4.9,145/240] powerpc/perf: Fix PMU constraint check for EBB events [4.9,146/240] powerpc: iommu: fix build when neither PCI or IBMVIO is set [4.9,147/240] mac80211: bail out if cipher schemes are invalid [4.9,148/240] mt7601u: fix always true expression [4.9,149/240] net: thunderx: Fix unintentional sign extension issue [4.9,150/240] i2c: cadence: add IRQ check [4.9,151/240] i2c: emev2: add IRQ check [4.9,152/240] i2c: jz4780: add IRQ check [4.9,153/240] i2c: sh7760: add IRQ check [4.9,154/240] MIPS: pci-legacy: stop using of_pci_range_to_resource [4.9,155/240] powerpc/pseries: extract host bridge from pci_bus prior to bus removal [4.9,156/240] i2c: sh7760: fix IRQ error path [4.9,157/240] mwl8k: Fix a double Free in mwl8k_probe_hw [4.9,158/240] vsock/vmci: log once the failed queue pair allocation [4.9,159/240] RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails [4.9,160/240] net: davinci_emac: Fix incorrect masking of tx and rx error channel [4.9,161/240] ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices [4.9,162/240] powerpc/52xx: Fix an invalid ASM expression (addi used instead of add) [4.9,163/240] net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send [4.9,164/240] net:nfc:digital: Fix a double free in digital_tg_recv_dep_req [4.9,165/240] kfifo: fix ternary sign extension bugs [4.9,166/240] Revert "net/sctp: fix race condition in sctp_destroy_sock" [4.9,167/240] sctp: delay auto_asconf init until binding the first addr [4.9,168/240] Revert "of/fdt: Make sure no-map does not remove already reserved regions" [4.9,169/240] Revert "fdt: Properly handle "no-map" field in the memory region" [4.9,170/240] fs: dlm: fix debugfs dump [4.9,171/240] tipc: convert dest nodes address to network order [4.9,172/240] net: stmmac: Set FIFO sizes for ipq806x [4.9,173/240] ALSA: hdsp: dont disable if not enabled [4.9,174/240] ALSA: hdspm: dont disable if not enabled [4.9,175/240] ALSA: rme9652: dont disable if not enabled [4.9,176/240] Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default [4.9,177/240] Bluetooth: initialize skb_queue_head at l2cap_chan_create() [4.9,178/240] ip6_vti: proper dev_{hold\|put} in ndo_[un]init methods [4.9,179/240] mac80211: clear the beacons CRC after channel switch [4.9,180/240] cuse: prevent clone [4.9,181/240] selftests: Set CC to clang in lib.mk if LLVM is set [4.9,182/240] kconfig: nconf: stop endless search loops [4.9,183/240] sctp: Fix out-of-bounds warning in sctp_process_asconf_param() [4.9,184/240] ASoC: rt286: Generalize support for ALC3263 codec [4.9,185/240] samples/bpf: Fix broken tracex1 due to kprobe argument change [4.9,186/240] powerpc/pseries: Stop calling printk in rtas_stop_self() [4.9,187/240] wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt [4.9,188/240] wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join [4.9,189/240] powerpc/iommu: Annotate nested lock for lockdep [4.9,190/240] net: ethernet: mtk_eth_soc: fix RX VLAN offload [4.9,191/240] ASoC: rt286: Make RT286_SET_GPIO_* readable and writable [4.9,192/240] f2fs: fix a redundant call to f2fs_balance_fs if an error occurs [4.9,193/240] PCI: Release OF node in pci_scan_device()s error path [4.9,194/240] ARM: 9064/1: hw_breakpoint: Do not directly check the events overflow_handler hook [4.9,195/240] NFSv4.2: Always flush out writes in nfs42_proc_fallocate() [4.9,196/240] NFS: Deal correctly with attribute generation counter overflow [4.9,197/240] pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() [4.9,198/240] NFSv4.2 fix handling of sr_eof in SEEKs reply [4.9,199/240] sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b [4.9,200/240] drm/radeon: Fix off-by-one power_state index heap overwrite [4.9,201/240] khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate() [4.9,202/240] mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() [4.9,203/240] ksm: fix potential missing rmap_item for stable_node [4.9,204/240] kernel: kexec_file: fix error return code of kexec_calculate_store_digests() [4.9,205/240] ARC: entry: fix off-by-one error in syscall number validation [4.9,206/240] powerpc/64s: Fix crashes when toggling entry flush barrier [4.9,207/240] squashfs: fix divide error in calculate_skip() [4.9,208/240] iio: proximity: pulsedlight: Fix rumtime PM imbalance on error [4.9,209/240] usb: fotg210-hcd: Fix an error message [4.9,210/240] ACPI: scan: Fix a memory leak in an error handling path [4.9,211/240] usb: xhci: Increase timeout for HC halt [4.9,212/240] usb: dwc2: Fix gadget DMA unmap direction [4.9,213/240] usb: core: hub: fix race condition about TRSMRCY of resume [4.9,214/240] KVM: x86: Cancel pvclock_gtod_work on module removal [4.9,215/240] FDDI: defxx: Make MMIO the configuration default except for EISA [4.9,216/240] MIPS: Reinstate platform `__div64_32 handler [4.9,217/240] MIPS: Avoid DIVU in `__div64_32 is result would be zero [4.9,218/240] MIPS: Avoid handcoded DIVU in `__div64_32 altogether [4.9,219/240] thermal/core/fair share: Lock the thermal zone while looping over instances [4.9,220/240] dm ioctl: fix out of bounds array access when no devices [4.9,221/240] kobject_uevent: remove warning in init_uevent_argv() [4.9,222/240] netfilter: conntrack: Make global sysctls readonly in non-init netns [4.9,223/240] clk: exynos7: Mark aclk_fsys1_200 as critical [4.9,224/240] x86/msr: Fix wr/rdmsr_safe_regs_on_cpu() prototypes [4.9,225/240] extcon: adc-jack: Fix incompatible pointer type warning [4.9,226/240] kgdb: fix gcc-11 warning on indentation [4.9,227/240] usb: sl811-hcd: improve misleading indentation [4.9,228/240] cxgb4: Fix the -Wmisleading-indentation warning [4.9,229/240] isdn: capi: fix mismatched prototypes [4.9,230/240] ARM: 9058/1: cache-v7: refactor v7_invalidate_l1 to avoid clobbering r5/r6 [4.9,231/240] ACPI / hotplug / PCI: Fix reference count leak in enable_slot() [4.9,232/240] Input: silead - add workaround for x86 BIOS-es which bring the chip up in a stuck s... [4.9,233/240] um: Mark all kernel symbols as local [4.9,234/240] ceph: fix fscache invalidation [4.9,235/240] ALSA: hda: generic: change the DAC ctl name for LO+SPK or LO+HP [4.9,236/240] lib: stackdepot: turn depot_lock spinlock to raw_spinlock [4.9,237/240] sit: proper dev_{hold\|put} in ndo_[un]init methods [4.9,238/240] ip6_tunnel: sit: proper dev_{hold\|put} in ndo_[un]init methods [4.9,239/240] xhci: Do not use GFP_KERNEL in (potentially) atomic context [4.9,240/240] ipv6: remove extra dev_hold() for fallback tunnels

Message ID

20210520092110.453629484@linuxfoundation.org

State

Superseded

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Kunkun Xu <xukunkun1@huawei.com>,
	lizhe <lizhe67@huawei.com>, Richard Weinberger <richard@nod.at>
Subject: [PATCH 4.9 053/240] jffs2: Fix kasan slab-out-of-bounds problem
Date: Thu, 20 May 2021 11:20:45 +0200
Message-Id: <20210520092110.453629484@linuxfoundation.org>
In-Reply-To: <20210520092108.587553970@linuxfoundation.org>
References: <20210520092108.587553970@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

None | expand

Commit Message

Greg KH May 20, 2021, 9:20 a.m. UTC

From: lizhe <lizhe67@huawei.com>

commit 960b9a8a7676b9054d8b46a2c7db52a0c8766b56 upstream.

KASAN report a slab-out-of-bounds problem. The logs are listed below.
It is because in function jffs2_scan_dirent_node, we alloc "checkedlen+1"
bytes for fd->name and we check crc with length rd->nsize. If checkedlen
is less than rd->nsize, it will cause the slab-out-of-bounds problem.

jffs2: Dirent at *** has zeroes in name. Truncating to %d char

==================================================================
BUG: KASAN: slab-out-of-bounds in crc32_le+0x1ce/0x260 at addr ffff8800842cf2d1
Read of size 1 by task test_JFFS2/915
=============================================================================
BUG kmalloc-64 (Tainted: G    B      O   ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in jffs2_alloc_full_dirent+0x2a/0x40 age=0 cpu=1 pid=915
	___slab_alloc+0x580/0x5f0
	__slab_alloc.isra.24+0x4e/0x64
	__kmalloc+0x170/0x300
	jffs2_alloc_full_dirent+0x2a/0x40
	jffs2_scan_eraseblock+0x1ca4/0x3b64
	jffs2_scan_medium+0x285/0xfe0
	jffs2_do_mount_fs+0x5fb/0x1bbc
	jffs2_do_fill_super+0x245/0x6f0
	jffs2_fill_super+0x287/0x2e0
	mount_mtd_aux.isra.0+0x9a/0x144
	mount_mtd+0x222/0x2f0
	jffs2_mount+0x41/0x60
	mount_fs+0x63/0x230
	vfs_kern_mount.part.6+0x6c/0x1f4
	do_mount+0xae8/0x1940
	SyS_mount+0x105/0x1d0
INFO: Freed in jffs2_free_full_dirent+0x22/0x40 age=27 cpu=1 pid=915
	__slab_free+0x372/0x4e4
	kfree+0x1d4/0x20c
	jffs2_free_full_dirent+0x22/0x40
	jffs2_build_remove_unlinked_inode+0x17a/0x1e4
	jffs2_do_mount_fs+0x1646/0x1bbc
	jffs2_do_fill_super+0x245/0x6f0
	jffs2_fill_super+0x287/0x2e0
	mount_mtd_aux.isra.0+0x9a/0x144
	mount_mtd+0x222/0x2f0
	jffs2_mount+0x41/0x60
	mount_fs+0x63/0x230
	vfs_kern_mount.part.6+0x6c/0x1f4
	do_mount+0xae8/0x1940
	SyS_mount+0x105/0x1d0
	entry_SYSCALL_64_fastpath+0x1e/0x97
Call Trace:
 [<ffffffff815befef>] dump_stack+0x59/0x7e
 [<ffffffff812d1d65>] print_trailer+0x125/0x1b0
 [<ffffffff812d82c8>] object_err+0x34/0x40
 [<ffffffff812dadef>] kasan_report.part.1+0x21f/0x534
 [<ffffffff81132401>] ? vprintk+0x2d/0x40
 [<ffffffff815f1ee2>] ? crc32_le+0x1ce/0x260
 [<ffffffff812db41a>] kasan_report+0x26/0x30
 [<ffffffff812d9fc1>] __asan_load1+0x3d/0x50
 [<ffffffff815f1ee2>] crc32_le+0x1ce/0x260
 [<ffffffff814764ae>] ? jffs2_alloc_full_dirent+0x2a/0x40
 [<ffffffff81485cec>] jffs2_scan_eraseblock+0x1d0c/0x3b64
 [<ffffffff81488813>] ? jffs2_scan_medium+0xccf/0xfe0
 [<ffffffff81483fe0>] ? jffs2_scan_make_ino_cache+0x14c/0x14c
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
 [<ffffffff812d5d90>] ? kmem_cache_alloc_trace+0x10c/0x2cc
 [<ffffffff818169fb>] ? mtd_point+0xf7/0x130
 [<ffffffff81487dc9>] jffs2_scan_medium+0x285/0xfe0
 [<ffffffff81487b44>] ? jffs2_scan_eraseblock+0x3b64/0x3b64
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
 [<ffffffff812da3e9>] ? kasan_unpoison_shadow+0x35/0x50
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
 [<ffffffff812d57df>] ? __kmalloc+0x12b/0x300
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
 [<ffffffff814a2753>] ? jffs2_sum_init+0x9f/0x240
 [<ffffffff8148b2ff>] jffs2_do_mount_fs+0x5fb/0x1bbc
 [<ffffffff8148ad04>] ? jffs2_del_noinode_dirent+0x640/0x640
 [<ffffffff812da462>] ? kasan_kmalloc+0x5e/0x70
 [<ffffffff81127c5b>] ? __init_rwsem+0x97/0xac
 [<ffffffff81492349>] jffs2_do_fill_super+0x245/0x6f0
 [<ffffffff81493c5b>] jffs2_fill_super+0x287/0x2e0
 [<ffffffff814939d4>] ? jffs2_parse_options+0x594/0x594
 [<ffffffff81819bea>] mount_mtd_aux.isra.0+0x9a/0x144
 [<ffffffff81819eb6>] mount_mtd+0x222/0x2f0
 [<ffffffff814939d4>] ? jffs2_parse_options+0x594/0x594
 [<ffffffff81819c94>] ? mount_mtd_aux.isra.0+0x144/0x144
 [<ffffffff81258757>] ? free_pages+0x13/0x1c
 [<ffffffff814fa0ac>] ? selinux_sb_copy_data+0x278/0x2e0
 [<ffffffff81492b35>] jffs2_mount+0x41/0x60
 [<ffffffff81302fb7>] mount_fs+0x63/0x230
 [<ffffffff8133755f>] ? alloc_vfsmnt+0x32f/0x3b0
 [<ffffffff81337f2c>] vfs_kern_mount.part.6+0x6c/0x1f4
 [<ffffffff8133ceec>] do_mount+0xae8/0x1940
 [<ffffffff811b94e0>] ? audit_filter_rules.constprop.6+0x1d10/0x1d10
 [<ffffffff8133c404>] ? copy_mount_string+0x40/0x40
 [<ffffffff812cbf78>] ? alloc_pages_current+0xa4/0x1bc
 [<ffffffff81253a89>] ? __get_free_pages+0x25/0x50
 [<ffffffff81338993>] ? copy_mount_options.part.17+0x183/0x264
 [<ffffffff8133e3a9>] SyS_mount+0x105/0x1d0
 [<ffffffff8133e2a4>] ? copy_mnt_ns+0x560/0x560
 [<ffffffff810e8391>] ? msa_space_switch_handler+0x13d/0x190
 [<ffffffff81be184a>] entry_SYSCALL_64_fastpath+0x1e/0x97
 [<ffffffff810e9274>] ? msa_space_switch+0xb0/0xe0
Memory state around the buggy address:
 ffff8800842cf180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8800842cf200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8800842cf280: fc fc fc fc fc fc 00 00 00 00 01 fc fc fc fc fc
                                                 ^
 ffff8800842cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8800842cf380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

Cc: stable@vger.kernel.org
Reported-by: Kunkun Xu <xukunkun1@huawei.com>
Signed-off-by: lizhe <lizhe67@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/jffs2/scan.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/jffs2/scan.c
+++ b/fs/jffs2/scan.c
@@ -1075,7 +1075,7 @@  static int jffs2_scan_dirent_node(struct
 	memcpy(&fd->name, rd->name, checkedlen);
 	fd->name[checkedlen] = 0;
 
-	crc = crc32(0, fd->name, rd->nsize);
+	crc = crc32(0, fd->name, checkedlen);
 	if (crc != je32_to_cpu(rd->name_crc)) {
 		pr_notice("%s(): Name CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
 			  __func__, ofs, je32_to_cpu(rd->name_crc), crc);

[4.9,053/240] jffs2: Fix kasan slab-out-of-bounds problem

Commit Message

Patch