linux-cve-announce - CVE-2025-38328: jffs2: check jffs2_prealloc_raw_node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025071032-CVE-2025-38328-43bf@gregkh>
Date: Thu, 10 Jul 2025 10:15:36 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38328: jffs2: check jffs2_prealloc_raw_node_refs() result in few other places

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

jffs2: check jffs2_prealloc_raw_node_refs() result in few other places

Fuzzing hit another invalid pointer dereference due to the lack of
checking whether jffs2_prealloc_raw_node_refs() completed successfully.
Subsequent logic implies that the node refs have been allocated.

Handle that. The code is ready for propagating the error upwards.

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 PID: 5835 Comm: syz-executor145 Not tainted 5.10.234-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:jffs2_link_node_ref+0xac/0x690 fs/jffs2/nodelist.c:600
Call Trace:
 jffs2_mark_erased_block fs/jffs2/erase.c:460 [inline]
 jffs2_erase_pending_blocks+0x688/0x1860 fs/jffs2/erase.c:118
 jffs2_garbage_collect_pass+0x638/0x1a00 fs/jffs2/gc.c:253
 jffs2_reserve_space+0x3f4/0xad0 fs/jffs2/nodemgmt.c:167
 jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362
 jffs2_write_end+0x712/0x1110 fs/jffs2/file.c:302
 generic_perform_write+0x2c2/0x500 mm/filemap.c:3347
 __generic_file_write_iter+0x252/0x610 mm/filemap.c:3465
 generic_file_write_iter+0xdb/0x230 mm/filemap.c:3497
 call_write_iter include/linux/fs.h:2039 [inline]
 do_iter_readv_writev+0x46d/0x750 fs/read_write.c:740
 do_iter_write+0x18c/0x710 fs/read_write.c:866
 vfs_writev+0x1db/0x6a0 fs/read_write.c:939
 do_pwritev fs/read_write.c:1036 [inline]
 __do_sys_pwritev fs/read_write.c:1083 [inline]
 __se_sys_pwritev fs/read_write.c:1078 [inline]
 __x64_sys_pwritev+0x235/0x310 fs/read_write.c:1078
 do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x67/0xd1

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

The Linux kernel CVE team has assigned CVE-2025-38328 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.18 with commit 2f785402f39b96a077b6e62bf26164bfb8e0c980 and fixed in 5.4.295 with commit 7e860296d7808de1db175c1eda29f94a2955dcc4
	Issue introduced in 2.6.18 with commit 2f785402f39b96a077b6e62bf26164bfb8e0c980 and fixed in 5.10.239 with commit d96e6451a8d0fe62492d4cc942d695772293c05a
	Issue introduced in 2.6.18 with commit 2f785402f39b96a077b6e62bf26164bfb8e0c980 and fixed in 5.15.186 with commit f41c625328777f9ad572901ba0b0065bb9c9c1da
	Issue introduced in 2.6.18 with commit 2f785402f39b96a077b6e62bf26164bfb8e0c980 and fixed in 6.1.142 with commit 38d767fb4a7766ec2058f97787e4c6e8d10343d6
	Issue introduced in 2.6.18 with commit 2f785402f39b96a077b6e62bf26164bfb8e0c980 and fixed in 6.6.95 with commit cd42ddddd70abc7127c12b96c8c85dbd080ea56f
	Issue introduced in 2.6.18 with commit 2f785402f39b96a077b6e62bf26164bfb8e0c980 and fixed in 6.12.35 with commit d1b81776f337a9b997f797c70ac0a26d838a2168
	Issue introduced in 2.6.18 with commit 2f785402f39b96a077b6e62bf26164bfb8e0c980 and fixed in 6.15.4 with commit 042fa922c84b5080401bcd8897d4ac4919d15075
	Issue introduced in 2.6.18 with commit 2f785402f39b96a077b6e62bf26164bfb8e0c980 and fixed in 6.16-rc1 with commit 2b6d96503255a3ed676cd70f8368870c6d6a25c6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38328
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/jffs2/erase.c
	fs/jffs2/scan.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7e860296d7808de1db175c1eda29f94a2955dcc4
	https://git.kernel.org/stable/c/d96e6451a8d0fe62492d4cc942d695772293c05a
	https://git.kernel.org/stable/c/f41c625328777f9ad572901ba0b0065bb9c9c1da
	https://git.kernel.org/stable/c/38d767fb4a7766ec2058f97787e4c6e8d10343d6
	https://git.kernel.org/stable/c/cd42ddddd70abc7127c12b96c8c85dbd080ea56f
	https://git.kernel.org/stable/c/d1b81776f337a9b997f797c70ac0a26d838a2168
	https://git.kernel.org/stable/c/042fa922c84b5080401bcd8897d4ac4919d15075
	https://git.kernel.org/stable/c/2b6d96503255a3ed676cd70f8368870c6d6a25c6