Reviewe-by: Joakim Tjernlund
It would be interesting to known how you managed to create such a dir entry as
that is a bug too.
From: linux-mtd on behalf of Zhe Li
Sent: 18 March 2021 04:06
To: rich...@nod.at; dw...@infradead.org; linux-...@lists.infradead.org;
linux-kernel@vger.kernel.org
Cc: lizh...@huawei.com; wangfangpe...@huawei.com; xukunk...@huawei.com;
zhongju...@huawei.com; chenj...@huawei.com
Subject: [PATCH] jffs2: fix kasan slab-out-of-bounds problem
From: lizhe
KASAN report a slab-out-of-bounds problem. The logs are listed below.
It is because in function jffs2_scan_dirent_node, we alloc "checkedlen+1"
bytes for fd->name and we check crc with length rd->nsize. If checkedlen
is less than rd->nsize, it will cause the slab-out-of-bounds problem.
jffs2: Dirent at *** has zeroes in name. Truncating to %d char
==
BUG: KASAN: slab-out-of-bounds in crc32_le+0x1ce/0x260 at addr 8800842cf2d1
Read of size 1 by task test_JFFS2/915
=
BUG kmalloc-64 (Tainted: GB O ): kasan: bad access detected
-
INFO: Allocated in jffs2_alloc_full_dirent+0x2a/0x40 age=0 cpu=1 pid=915
___slab_alloc+0x580/0x5f0
__slab_alloc.isra.24+0x4e/0x64
__kmalloc+0x170/0x300
jffs2_alloc_full_dirent+0x2a/0x40
jffs2_scan_eraseblock+0x1ca4/0x3b64
jffs2_scan_medium+0x285/0xfe0
jffs2_do_mount_fs+0x5fb/0x1bbc
jffs2_do_fill_super+0x245/0x6f0
jffs2_fill_super+0x287/0x2e0
mount_mtd_aux.isra.0+0x9a/0x144
mount_mtd+0x222/0x2f0
jffs2_mount+0x41/0x60
mount_fs+0x63/0x230
vfs_kern_mount.part.6+0x6c/0x1f4
do_mount+0xae8/0x1940
SyS_mount+0x105/0x1d0
INFO: Freed in jffs2_free_full_dirent+0x22/0x40 age=27 cpu=1 pid=915
__slab_free+0x372/0x4e4
kfree+0x1d4/0x20c
jffs2_free_full_dirent+0x22/0x40
jffs2_build_remove_unlinked_inode+0x17a/0x1e4
jffs2_do_mount_fs+0x1646/0x1bbc
jffs2_do_fill_super+0x245/0x6f0
jffs2_fill_super+0x287/0x2e0
mount_mtd_aux.isra.0+0x9a/0x144
mount_mtd+0x222/0x2f0
jffs2_mount+0x41/0x60
mount_fs+0x63/0x230
vfs_kern_mount.part.6+0x6c/0x1f4
do_mount+0xae8/0x1940
SyS_mount+0x105/0x1d0
entry_SYSCALL_64_fastpath+0x1e/0x97
Call Trace:
[] dump_stack+0x59/0x7e
[] print_trailer+0x125/0x1b0
[] object_err+0x34/0x40
[] kasan_report.part.1+0x21f/0x534
[] ? vprintk+0x2d/0x40
[] ? crc32_le+0x1ce/0x260
[] kasan_report+0x26/0x30
[] __asan_load1+0x3d/0x50
[] crc32_le+0x1ce/0x260
[] ? jffs2_alloc_full_dirent+0x2a/0x40
[] jffs2_scan_eraseblock+0x1d0c/0x3b64
[] ? jffs2_scan_medium+0xccf/0xfe0
[] ? jffs2_scan_make_ino_cache+0x14c/0x14c
[] ? kasan_unpoison_shadow+0x35/0x50
[] ? kasan_unpoison_shadow+0x35/0x50
[] ? kasan_kmalloc+0x5e/0x70
[] ? kmem_cache_alloc_trace+0x10c/0x2cc
[] ? mtd_point+0xf7/0x130
[] jffs2_scan_medium+0x285/0xfe0
[] ? jffs2_scan_eraseblock+0x3b64/0x3b64
[] ? kasan_unpoison_shadow+0x35/0x50
[] ? kasan_unpoison_shadow+0x35/0x50
[] ? kasan_kmalloc+0x5e/0x70
[] ? __kmalloc+0x12b/0x300
[] ? kasan_kmalloc+0x5e/0x70
[] ? jffs2_sum_init+0x9f/0x240
[] jffs2_do_mount_fs+0x5fb/0x1bbc
[] ? jffs2_del_noinode_dirent+0x640/0x640
[] ? kasan_kmalloc+0x5e/0x70
[] ? __init_rwsem+0x97/0xac
[] jffs2_do_fill_super+0x245/0x6f0
[] jffs2_fill_super+0x287/0x2e0
[] ? jffs2_parse_options+0x594/0x594
[] mount_mtd_aux.isra.0+0x9a/0x144
[] mount_mtd+0x222/0x2f0
[] ? jffs2_parse_options+0x594/0x594
[] ? mount_mtd_aux.isra.0+0x144/0x144
[] ? free_pages+0x13/0x1c
[] ? selinux_sb_copy_data+0x278/0x2e0
[] jffs2_mount+0x41/0x60
[] mount_fs+0x63/0x230
[] ? alloc_vfsmnt+0x32f/0x3b0
[] vfs_kern_mount.part.6+0x6c/0x1f4
[] do_mount+0xae8/0x1940
[] ? audit_filter_rules.constprop.6+0x1d10/0x1d10
[] ? copy_mount_string+0x40/0x40
[] ? alloc_pages_current+0xa4/0x1bc
[] ? __get_free_pages+0x25/0x50
[] ? copy_mount_options.part.17+0x183/0x264
[] SyS_mount+0x105/0x1d0
[] ? copy_mnt_ns+0x560/0x560
[] ? msa_space_switch_handler+0x13d/0x190
[] entry_SYSCALL_64_fastpath+0x1e/0x97
[] ? msa_space_switch+0xb0/0xe0
Memory state around the buggy address:
8800842cf180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
8800842cf200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>8800842cf280: fc fc fc fc fc fc 00 00 00 00 01 fc fc fc fc fc
^
8800842cf300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
8800842cf380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==
Reported-by: Kunkun Xu
Signed-off-by: lizhe
---
fs/jffs2/scan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff
