From patchwork Mon Dec 5 15:00:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gao Xiang X-Patchwork-Id: 29710 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp2303552wrr; Mon, 5 Dec 2022 07:02:28 -0800 (PST) X-Google-Smtp-Source: AA0mqf5b8Wo8f6kFvAy0HVELxXXGR90qCbSrACnWe8Y206KdJTdYR2SoUgYXDkVo7FlPxP8/mRWc X-Received: by 2002:a63:d946:0:b0:477:af25:38c8 with SMTP id e6-20020a63d946000000b00477af2538c8mr54602729pgj.392.1670252548563; Mon, 05 Dec 2022 07:02:28 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1670252548; cv=none; d=google.com; s=arc-20160816; b=OeMBVd0LaOx7R47El9rmpnadXsFvKd9nRWiDmU+LrdN1/vw3dQUEP9U/6Ayx4ZlnX3 TfHjGNBtgooyQ00b1mfmt6GZ0UTjWtNOddKCDjzwi1wjDhvLOiN7QRuF3ROVqZLDXhan GabH3J6dSZtswTK9RjEWpFUBv8UZVfABPVc20/706wgFPeY54l9PMaQlYc5NYzl+9Vnf xBbYnE6iS5a5bnyJ3U4YeSZElOh0SV9YQHKTzdQbWncptMrrwU+sSX1mKNYr60TvqZK2 3BZRUdI3TVBNcksi2+tM+qBZFerUrojv/OPPpGdXifV/DUjLZBMz8js38hKYOQCO4JkE EV3w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=xD7f8lnicWaGRodZ3XHs72LXWQ5rJ87fEHJyOndcnPU=; b=XoRz0cQCV4KQdAzjfRAGTXHrdRcmjF/7Jjpzpr7k2umIvPC6AgzkzB/Klj0SfJFxkq LnR8f2lU3DOPNrR6A8XKlHrT2qLA1OJjKj+enwVh67x5TCW/0uI4mczPRwX4icwStgFH WwK7ANivMrJd4ScqV0J/vEHr7wx6tqQ5kpKimUlKhTWnjrtNvngBzcz854bdJXU9jp19 Mi/UNEYBOaSyEo/B/xGD+X4kPDZ/VQ/Gp+ecxURP4gHxVaIgjlqGmFyDL+D2Sx94zsl0 LuAj84KI73EZcBdaH7PqQ0hwhk6f7BIv8ll4us25h0HgWlSu2UCyLyCr2jg7+mET3bRL PRng== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id e1-20020a17090301c100b0018873ba17ccsi15835593plh.32.2022.12.05.07.02.05; Mon, 05 Dec 2022 07:02:28 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231960AbiLEPBW (ORCPT + 99 others); Mon, 5 Dec 2022 10:01:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33334 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232341AbiLEPBD (ORCPT ); Mon, 5 Dec 2022 10:01:03 -0500 Received: from out30-43.freemail.mail.aliyun.com (out30-43.freemail.mail.aliyun.com [115.124.30.43]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3F0A11D0FD for ; Mon, 5 Dec 2022 07:01:01 -0800 (PST) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R321e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046059;MF=hsiangkao@linux.alibaba.com;NM=0;PH=DS;RN=5;SR=0;TI=SMTPD_---0VWWWV0Z_1670252457; Received: from e18g06460.et15sqa.tbsite.net(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0VWWWV0Z_1670252457) by smtp.aliyun-inc.com; Mon, 05 Dec 2022 23:00:58 +0800 From: Gao Xiang To: linux-erofs@lists.ozlabs.org, Chao Yu Cc: LKML , Gao Xiang , syzbot+2ae90e873e97f1faf6f2@syzkaller.appspotmail.com Subject: [PATCH 2/2] erofs: validate the extent length for uncompressed pclusters Date: Mon, 5 Dec 2022 23:00:50 +0800 Message-Id: <20221205150050.47784-2-hsiangkao@linux.alibaba.com> X-Mailer: git-send-email 2.24.4 In-Reply-To: <20221205150050.47784-1-hsiangkao@linux.alibaba.com> References: <20221205150050.47784-1-hsiangkao@linux.alibaba.com> MIME-Version: 1.0 X-Spam-Status: No, score=-9.9 required=5.0 tests=BAYES_00, ENV_AND_HDR_SPF_MATCH,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2, SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY,USER_IN_DEF_SPF_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1751386736355714394?= X-GMAIL-MSGID: =?utf-8?q?1751386736355714394?= syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2 The referenced fuzzed image actually has two issues: - m_pa == 0 as a non-inlined pcluster; - The logical length is longer than its physical length. The first issue has already been addressed. This patch addresses the second issue by checking the extent length validity. Reported-by: syzbot+2ae90e873e97f1faf6f2@syzkaller.appspotmail.com Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter") Signed-off-by: Gao Xiang Reviewed-by: Chao Yu --- fs/erofs/zmap.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 98eff1259de4..0150570c33aa 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -698,6 +698,11 @@ static int z_erofs_do_map_blocks(struct inode *inode, } if (m.headtype == Z_EROFS_VLE_CLUSTER_TYPE_PLAIN) { + if (map->m_llen > map->m_plen) { + DBG_BUGON(1); + err = -EFSCORRUPTED; + goto unmap_out; + } if (vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER) map->m_algorithmformat = Z_EROFS_COMPRESSION_INTERLACED;