linux-kernel - Re: [PATCH] jffs2: check the validity of dstlen in jffs2_zlib

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 28 Jan 2021 12:22:36 +0100 (CET)
From:   Richard Weinberger <richard@....at>
To:     Joakim Tjernlund <Joakim.Tjernlund@...inera.com>
Cc:     menglong8 dong <menglong8.dong@...il.com>,
        David Woodhouse <dwmw2@...radead.org>,
        yang yang29 <yang.yang29@....com.cn>,
        stable <stable@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        linux-mtd <linux-mtd@...ts.infradead.org>
Subject: Re: [PATCH] jffs2: check the validity of dstlen in
 jffs2_zlib_compress()

----- Ursprüngliche Mail -----
> Von: "Joakim Tjernlund" <Joakim.Tjernlund@...inera.com>
> An: "menglong8 dong" <menglong8.dong@...il.com>, "David Woodhouse" <dwmw2@...radead.org>
> CC: "yang yang29" <yang.yang29@....com.cn>, "stable" <stable@...r.kernel.org>, "linux-kernel"
> <linux-kernel@...r.kernel.org>, "richard" <richard@....at>, "linux-mtd" <linux-mtd@...ts.infradead.org>
> Gesendet: Donnerstag, 28. Januar 2021 12:17:34
> Betreff: Re: [PATCH] jffs2: check the validity of dstlen in jffs2_zlib_compress()

> On Thu, 2021-01-28 at 02:55 -0800, menglong8.dong@...il.com wrote:
>> From: Yang Yang <yang.yang29@....com.cn>
>> 
>> KASAN reports a BUG when download file in jffs2 filesystem.It is
>> because when dstlen == 1, cpage_out will write array out of bounds.
>> Actually, data will not be compressed in jffs2_zlib_compress() if
>> data's length less than 4.
> 
> Ouch, data corruption will ensue. Good find!
> I think this needs to go to stable as well.

Indeed! Do you know whether this is a regression?
Seems to be like that since ever.

Thanks,
//richard