* [PATCH] erofs: fix out-of-bound read for shifted uncompressed block
@ 2020-01-07 2:25 Gao Xiang
2020-01-11 9:20 ` Chao Yu
0 siblings, 1 reply; 2+ messages in thread
From: Gao Xiang @ 2020-01-07 2:25 UTC (permalink / raw)
To: Chao Yu; +Cc: linux-erofs, LKML, stable, Miao Xie
rq->out[1] should be valid before accessing. Otherwise,
in very rare cases, out-of-bound dirty onstack rq->out[1]
can equal to *in and lead to unintended memmove behavior.
Fixes: 7fc45dbc938a ("staging: erofs: introduce generic decompression backend")
Cc: <stable@vger.kernel.org> # v5.3+
Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
---
fs/erofs/decompressor.c | 22 ++++++++++------------
1 file changed, 10 insertions(+), 12 deletions(-)
diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index 2890a67a1ded..5779a15c2cd6 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -306,24 +306,22 @@ static int z_erofs_shifted_transform(const struct z_erofs_decompress_req *rq,
}
src = kmap_atomic(*rq->in);
- if (!rq->out[0]) {
- dst = NULL;
- } else {
+ if (rq->out[0]) {
dst = kmap_atomic(rq->out[0]);
memcpy(dst + rq->pageofs_out, src, righthalf);
+ kunmap_atomic(dst);
}
- if (rq->out[1] == *rq->in) {
- memmove(src, src + righthalf, rq->pageofs_out);
- } else if (nrpages_out == 2) {
- if (dst)
- kunmap_atomic(dst);
+ if (nrpages_out == 2) {
DBG_BUGON(!rq->out[1]);
- dst = kmap_atomic(rq->out[1]);
- memcpy(dst, src + righthalf, rq->pageofs_out);
+ if (rq->out[1] == *rq->in) {
+ memmove(src, src + righthalf, rq->pageofs_out);
+ } else {
+ dst = kmap_atomic(rq->out[1]);
+ memcpy(dst, src + righthalf, rq->pageofs_out);
+ kunmap_atomic(dst);
+ }
}
- if (dst)
- kunmap_atomic(dst);
kunmap_atomic(src);
return 0;
}
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] erofs: fix out-of-bound read for shifted uncompressed block
2020-01-07 2:25 [PATCH] erofs: fix out-of-bound read for shifted uncompressed block Gao Xiang
@ 2020-01-11 9:20 ` Chao Yu
0 siblings, 0 replies; 2+ messages in thread
From: Chao Yu @ 2020-01-11 9:20 UTC (permalink / raw)
To: Gao Xiang; +Cc: linux-erofs, LKML, stable, Miao Xie
On 2020/1/7 10:25, Gao Xiang wrote:
> rq->out[1] should be valid before accessing. Otherwise,
> in very rare cases, out-of-bound dirty onstack rq->out[1]
> can equal to *in and lead to unintended memmove behavior.
>
> Fixes: 7fc45dbc938a ("staging: erofs: introduce generic decompression backend")
> Cc: <stable@vger.kernel.org> # v5.3+
> Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Thanks,
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-01-11 9:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-07 2:25 [PATCH] erofs: fix out-of-bound read for shifted uncompressed block Gao Xiang
2020-01-11 9:20 ` Chao Yu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).