linux-kernel - Re: [PATCH] jffs2: check that raw node were preallocated before writing summary

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6d0b7143-8e36-6bb7-16c1-817ef3287e10@huawei.com>
Date: Sat, 8 Mar 2025 12:13:09 +0800
From: Zhihao Cheng <chengzhihao1@...wei.com>
To: Artem Sadovnikov <a.sadovnikov@...ras.ru>, <linux-mtd@...ts.infradead.org>
CC: David Woodhouse <dwmw2@...radead.org>, Richard Weinberger
	<richard@....at>, <linux-kernel@...r.kernel.org>,
	<lvc-project@...uxtesting.org>, <stable@...r.kernel.org>
Subject: Re: [PATCH] jffs2: check that raw node were preallocated before
 writing summary

在 2025/3/8 0:34, Artem Sadovnikov 写道:
> Syzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault
> injection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn't
> check return value of jffs2_prealloc_raw_node_refs and simply lets any
> error propagate into jffs2_sum_write_data, which eventually calls
> jffs2_link_node_ref in order to link the summary to an expectedly allocated
> node.
> 
> kernel BUG at fs/jffs2/nodelist.c:592!
> invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
> CPU: 1 PID: 31277 Comm: syz-executor.7 Not tainted 6.1.128-syzkaller-00139-ge10f83ca10a1 #0
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
> RIP: 0010:jffs2_link_node_ref+0x570/0x690 fs/jffs2/nodelist.c:592
> Call Trace:
>   <TASK>
>   jffs2_sum_write_data fs/jffs2/summary.c:841 [inline]
>   jffs2_sum_write_sumnode+0xd1a/0x1da0 fs/jffs2/summary.c:874
>   jffs2_do_reserve_space+0xa18/0xd60 fs/jffs2/nodemgmt.c:388
>   jffs2_reserve_space+0x55f/0xaa0 fs/jffs2/nodemgmt.c:197
>   jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362
>   jffs2_write_end+0x726/0x15d0 fs/jffs2/file.c:301
>   generic_perform_write+0x314/0x5d0 mm/filemap.c:3856
>   __generic_file_write_iter+0x2ae/0x4d0 mm/filemap.c:3973
>   generic_file_write_iter+0xe3/0x350 mm/filemap.c:4005
>   call_write_iter include/linux/fs.h:2265 [inline]
>   do_iter_readv_writev+0x20f/0x3c0 fs/read_write.c:735
>   do_iter_write+0x186/0x710 fs/read_write.c:861
>   vfs_iter_write+0x70/0xa0 fs/read_write.c:902
>   iter_file_splice_write+0x73b/0xc90 fs/splice.c:685
>   do_splice_from fs/splice.c:763 [inline]
>   direct_splice_actor+0x10c/0x170 fs/splice.c:950
>   splice_direct_to_actor+0x337/0xa10 fs/splice.c:896
>   do_splice_direct+0x1a9/0x280 fs/splice.c:1002
>   do_sendfile+0xb13/0x12c0 fs/read_write.c:1255
>   __do_sys_sendfile64 fs/read_write.c:1323 [inline]
>   __se_sys_sendfile64 fs/read_write.c:1309 [inline]
>   __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309
>   do_syscall_x64 arch/x86/entry/common.c:51 [inline]
>   do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81
>   entry_SYSCALL_64_after_hwframe+0x6e/0xd8
> 
> Fix this issue by checking return value of jffs2_prealloc_raw_node_refs
> before calling jffs2_sum_write_data.
> 
> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
> 
> Cc: stable@...r.kernel.org
> Fixes: 2f785402f39b ("[JFFS2] Reduce visibility of raw_node_ref to upper layers of JFFS2 code.")
> Signed-off-by: Artem Sadovnikov <a.sadovnikov@...ras.ru>
> ---
>   fs/jffs2/summary.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
> 

Reviewed-by: Zhihao Cheng <chengzhihao1@...wei.com>
> diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c
> index 4fe64519870f1..d83372d3e1a07 100644
> --- a/fs/jffs2/summary.c
> +++ b/fs/jffs2/summary.c
> @@ -858,7 +858,10 @@ int jffs2_sum_write_sumnode(struct jffs2_sb_info *c)
>   	spin_unlock(&c->erase_completion_lock);
>   
>   	jeb = c->nextblock;
> -	jffs2_prealloc_raw_node_refs(c, jeb, 1);
> +	ret = jffs2_prealloc_raw_node_refs(c, jeb, 1);
> +
> +	if (ret)
> +		goto out;
>   
>   	if (!c->summary->sum_num || !c->summary->sum_list_head) {
>   		JFFS2_WARNING("Empty summary info!!!\n");
> @@ -872,6 +875,8 @@ int jffs2_sum_write_sumnode(struct jffs2_sb_info *c)
>   	datasize += padsize;
>   
>   	ret = jffs2_sum_write_data(c, jeb, infosize, datasize, padsize);
> +
> +out:
>   	spin_lock(&c->erase_completion_lock);
>   	return ret;
>   }
>