From patchwork Mon Dec 5 15:00:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gao Xiang X-Patchwork-Id: 29709 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp2303379wrr; Mon, 5 Dec 2022 07:02:17 -0800 (PST) X-Google-Smtp-Source: AA0mqf6NB4vJEhMQy6VUf1zZAvDZgPeyFxeNPFGm3ShvlLZFYUn78zQWB+oKGo03T2CD5wcbm8rE X-Received: by 2002:a17:90a:de10:b0:218:c568:4214 with SMTP id m16-20020a17090ade1000b00218c5684214mr70445211pjv.135.1670252536595; Mon, 05 Dec 2022 07:02:16 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1670252536; cv=none; d=google.com; s=arc-20160816; b=jX180Ovw6jOOlk4DIsRwX7HUxA7Kywjw52L5wynoMNBXiqNadsJxWoAapIk7P9Fm1o GxfBJ1dlMmP4yKicSmbW/jMza25AxiDLvfb6Q4UoB5h9VfWWspM+7BhLQaS9CP+5P42w r6cFCktPQrCNPdlbrVm5bFS4g8naR/umtriV8kQnIE3tHCY5P6lNJ2+QX7c3SL5DvIxT HmAAc2CEd672WAZNxpg8jHs9MUjOXAUkR2W4JyQfNawiuZl51lG/siGIZ2CoJbU7bQiV 2r6+3Pk7LqCL0VCLsR9QDoXC8JVXnOZr+ykHwvmt4xZAgdEzdgO3Zju/SQi9bdcCNmFr U9eQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=D5ujaqa7l06W6XmV27jTwokxK8beGBZxBlcPow8GXxg=; b=HQcJZHEhtqjGcPIn4WLB5x4HQuNLk1HNYmyRWQxub7NH3gN3Tbc458o++yYGkWHoFX 57Umdh28wKqZOkh074cZXJUABjvnes3bsVbXbXidMW8T6Ocmulgf5EWD+z++WlfrKDZX qtm5fcA46WV7/bkATYoDzpTIh9zGkgCAI5vD39NmlpmCoUY1ejPTrfby4SU7kklx3lbn zWam9pSX7rfDGti6rl2EIcfG3UezYiWAXaeEUZuiasrRiTr+Ud2cJ/mcnwOSAmvzYXRZ pRt9l6mDSj8nG1oUA2Q74cHE+nbSygvXZ/0h3YCeUkdRwUlLDb34wmpTYrsJLbBIDt1z y+QA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id y3-20020a631803000000b00476ddb08ed0si14706282pgl.446.2022.12.05.07.01.52; Mon, 05 Dec 2022 07:02:16 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229970AbiLEPBS (ORCPT + 99 others); Mon, 5 Dec 2022 10:01:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33036 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232169AbiLEPBB (ORCPT ); Mon, 5 Dec 2022 10:01:01 -0500 Received: from out30-7.freemail.mail.aliyun.com (out30-7.freemail.mail.aliyun.com [115.124.30.7]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5D1A61DA6C for ; Mon, 5 Dec 2022 07:00:59 -0800 (PST) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R101e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046049;MF=hsiangkao@linux.alibaba.com;NM=0;PH=DS;RN=4;SR=0;TI=SMTPD_---0VWWWV.3_1670252451; Received: from e18g06460.et15sqa.tbsite.net(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0VWWWV.3_1670252451) by smtp.aliyun-inc.com; Mon, 05 Dec 2022 23:00:57 +0800 From: Gao Xiang To: linux-erofs@lists.ozlabs.org, Chao Yu Cc: LKML , Gao Xiang Subject: [PATCH 1/2] erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails Date: Mon, 5 Dec 2022 23:00:49 +0800 Message-Id: <20221205150050.47784-1-hsiangkao@linux.alibaba.com> X-Mailer: git-send-email 2.24.4 MIME-Version: 1.0 X-Spam-Status: No, score=-9.9 required=5.0 tests=BAYES_00, ENV_AND_HDR_SPF_MATCH,SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY, USER_IN_DEF_SPF_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1751386723708836172?= X-GMAIL-MSGID: =?utf-8?q?1751386723708836172?= Otherwise, meta buffers could be leaked. Fixes: cec6e93beadf ("erofs: support parsing big pcluster compress indexes") Signed-off-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu --- fs/erofs/zmap.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 749a5ac943f4..98eff1259de4 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -694,7 +694,7 @@ static int z_erofs_do_map_blocks(struct inode *inode, map->m_pa = blknr_to_addr(m.pblk); err = z_erofs_get_extent_compressedlen(&m, initial_lcn); if (err) - goto out; + goto unmap_out; } if (m.headtype == Z_EROFS_VLE_CLUSTER_TYPE_PLAIN) { @@ -718,14 +718,12 @@ static int z_erofs_do_map_blocks(struct inode *inode, if (!err) map->m_flags |= EROFS_MAP_FULL_MAPPED; } + unmap_out: erofs_unmap_metabuf(&m.map->buf); - -out: erofs_dbg("%s, m_la %llu m_pa %llu m_llen %llu m_plen %llu m_flags 0%o", __func__, map->m_la, map->m_pa, map->m_llen, map->m_plen, map->m_flags); - return err; } From patchwork Mon Dec 5 15:00:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gao Xiang X-Patchwork-Id: 29710 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp2303552wrr; Mon, 5 Dec 2022 07:02:28 -0800 (PST) X-Google-Smtp-Source: AA0mqf5b8Wo8f6kFvAy0HVELxXXGR90qCbSrACnWe8Y206KdJTdYR2SoUgYXDkVo7FlPxP8/mRWc X-Received: by 2002:a63:d946:0:b0:477:af25:38c8 with SMTP id e6-20020a63d946000000b00477af2538c8mr54602729pgj.392.1670252548563; Mon, 05 Dec 2022 07:02:28 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1670252548; cv=none; d=google.com; s=arc-20160816; b=OeMBVd0LaOx7R47El9rmpnadXsFvKd9nRWiDmU+LrdN1/vw3dQUEP9U/6Ayx4ZlnX3 TfHjGNBtgooyQ00b1mfmt6GZ0UTjWtNOddKCDjzwi1wjDhvLOiN7QRuF3ROVqZLDXhan GabH3J6dSZtswTK9RjEWpFUBv8UZVfABPVc20/706wgFPeY54l9PMaQlYc5NYzl+9Vnf xBbYnE6iS5a5bnyJ3U4YeSZElOh0SV9YQHKTzdQbWncptMrrwU+sSX1mKNYr60TvqZK2 3BZRUdI3TVBNcksi2+tM+qBZFerUrojv/OPPpGdXifV/DUjLZBMz8js38hKYOQCO4JkE EV3w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=xD7f8lnicWaGRodZ3XHs72LXWQ5rJ87fEHJyOndcnPU=; b=XoRz0cQCV4KQdAzjfRAGTXHrdRcmjF/7Jjpzpr7k2umIvPC6AgzkzB/Klj0SfJFxkq LnR8f2lU3DOPNrR6A8XKlHrT2qLA1OJjKj+enwVh67x5TCW/0uI4mczPRwX4icwStgFH WwK7ANivMrJd4ScqV0J/vEHr7wx6tqQ5kpKimUlKhTWnjrtNvngBzcz854bdJXU9jp19 Mi/UNEYBOaSyEo/B/xGD+X4kPDZ/VQ/Gp+ecxURP4gHxVaIgjlqGmFyDL+D2Sx94zsl0 LuAj84KI73EZcBdaH7PqQ0hwhk6f7BIv8ll4us25h0HgWlSu2UCyLyCr2jg7+mET3bRL PRng== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id e1-20020a17090301c100b0018873ba17ccsi15835593plh.32.2022.12.05.07.02.05; Mon, 05 Dec 2022 07:02:28 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231960AbiLEPBW (ORCPT + 99 others); Mon, 5 Dec 2022 10:01:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33334 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232341AbiLEPBD (ORCPT ); Mon, 5 Dec 2022 10:01:03 -0500 Received: from out30-43.freemail.mail.aliyun.com (out30-43.freemail.mail.aliyun.com [115.124.30.43]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3F0A11D0FD for ; Mon, 5 Dec 2022 07:01:01 -0800 (PST) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R321e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046059;MF=hsiangkao@linux.alibaba.com;NM=0;PH=DS;RN=5;SR=0;TI=SMTPD_---0VWWWV0Z_1670252457; Received: from e18g06460.et15sqa.tbsite.net(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0VWWWV0Z_1670252457) by smtp.aliyun-inc.com; Mon, 05 Dec 2022 23:00:58 +0800 From: Gao Xiang To: linux-erofs@lists.ozlabs.org, Chao Yu Cc: LKML , Gao Xiang , syzbot+2ae90e873e97f1faf6f2@syzkaller.appspotmail.com Subject: [PATCH 2/2] erofs: validate the extent length for uncompressed pclusters Date: Mon, 5 Dec 2022 23:00:50 +0800 Message-Id: <20221205150050.47784-2-hsiangkao@linux.alibaba.com> X-Mailer: git-send-email 2.24.4 In-Reply-To: <20221205150050.47784-1-hsiangkao@linux.alibaba.com> References: <20221205150050.47784-1-hsiangkao@linux.alibaba.com> MIME-Version: 1.0 X-Spam-Status: No, score=-9.9 required=5.0 tests=BAYES_00, ENV_AND_HDR_SPF_MATCH,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2, SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY,USER_IN_DEF_SPF_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1751386736355714394?= X-GMAIL-MSGID: =?utf-8?q?1751386736355714394?= syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2 The referenced fuzzed image actually has two issues: - m_pa == 0 as a non-inlined pcluster; - The logical length is longer than its physical length. The first issue has already been addressed. This patch addresses the second issue by checking the extent length validity. Reported-by: syzbot+2ae90e873e97f1faf6f2@syzkaller.appspotmail.com Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter") Signed-off-by: Gao Xiang Reviewed-by: Chao Yu --- fs/erofs/zmap.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 98eff1259de4..0150570c33aa 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -698,6 +698,11 @@ static int z_erofs_do_map_blocks(struct inode *inode, } if (m.headtype == Z_EROFS_VLE_CLUSTER_TYPE_PLAIN) { + if (map->m_llen > map->m_plen) { + DBG_BUGON(1); + err = -EFSCORRUPTED; + goto unmap_out; + } if (vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER) map->m_algorithmformat = Z_EROFS_COMPRESSION_INTERLACED;