From: Gao Xiang <hsiangkao@linux.alibaba.com> stable inclusion from stable-v6.0.16 commit dc8b6bd587b13b85aff6e9d36cdfcd3f955cac9e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12925 CVE: CVE-2022-50746 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit c505feba4c0d76084e56ec498ce819f02a7043ae ] syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2 The referenced fuzzed image actually has two issues: - m_pa == 0 as a non-inlined pcluster; - The logical length is longer than its physical length. The first issue has already been addressed. This patch addresses the second issue by checking the extent length validity. Reported-by: syzbot+2ae90e873e97f1faf6f2@syzkaller.appspotmail.com Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter") Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> Link: https://lore.kernel.org/r/20221205150050.47784-2-hsiangkao@linux.alibaba.com Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: fs/erofs/zmap.c [Commit 8f89926290c4 ("erofs: get compression algorithms directly on mapping") is not merged in 5.10, so z_erofs_maprecorder has no member named "headtype". But in high version code in z_erofs_do_map_blocks() contexts, m.type == m.headtype because of the calling of z_erofs_extent_lookback(). So modify it by using m.type instead of m.headtype.] Signed-off-by: Zizhi Wo <wozizhi@huawei.com> --- fs/erofs/zmap.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 840e795a7c70..f8fc587274d7 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -437,6 +437,13 @@ int z_erofs_map_blocks_iter(struct inode *inode, map->m_pa = blknr_to_addr(m.pblk); map->m_flags |= EROFS_MAP_MAPPED; + if (m.type == Z_EROFS_VLE_CLUSTER_TYPE_PLAIN) { + if (map->m_llen > map->m_plen) { + DBG_BUGON(1); + err = -EFSCORRUPTED; + } + } + unmap_out: erofs_unmap_metabuf(&m.map->buf); -- 2.39.2