From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4FDD8C3A5A1 for ; Thu, 22 Aug 2019 12:15:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 24FA723402 for ; Thu, 22 Aug 2019 12:15:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1566476107; bh=janQySLwzPTIPq9O63pGYZUUmY2YkrALxMlbYHP+nfI=; h=Subject:To:From:Date:List-ID:From; b=Kk/mnLAr1wHszhVpHPGFCxMzviawWgwQCmLzjrAyRxF4zK46PkeV8uHTm05VAqvf/ Gq8xLmWhcJBsFAyKwcBZ8iiISPOn9NpLUPViEu98GCRjXv3TY9EmIRg7v/NKg/YUf1 VCAXh2/0+kFFJXGyvi/Bk9TOHCmxIbIhaJRcUhZQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730857AbfHVMPG (ORCPT ); Thu, 22 Aug 2019 08:15:06 -0400 Received: from mail.kernel.org ([198.145.29.99]:45144 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729716AbfHVMPG (ORCPT ); Thu, 22 Aug 2019 08:15:06 -0400 Received: from localhost (unknown [12.166.174.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 21FF321848; Thu, 22 Aug 2019 12:15:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1566476105; bh=janQySLwzPTIPq9O63pGYZUUmY2YkrALxMlbYHP+nfI=; h=Subject:To:From:Date:From; b=ZSFqWARb+Pk0Us6RnWKhAqXBFX3gPmfW9yvFl8I6kpWyR+dwvYaIhBtMC11YI43yL 4RXWUq4bMlEM0+GaDgSGLt0t1w33qMnM5KnAZlqB7KVFrycYXDHO9lB6NVUcAewd2w suKEzPyMOIX+NDLb2NoX22uYOx+A3uFpsPJYnExs= Subject: patch "staging: erofs: detect potential multiref due to corrupted images" added to staging-next To: gaoxiang25@huawei.com, gregkh@linuxfoundation.org, stable@vger.kernel.org, yuchao0@huawei.com From: Date: Thu, 22 Aug 2019 05:15:04 -0700 Message-ID: <156647610471213@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org This is a note to let you know that I've just added the patch titled staging: erofs: detect potential multiref due to corrupted images to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From e12a0ce2fa69798194f3a8628baf6edfbd5c548f Mon Sep 17 00:00:00 2001 From: Gao Xiang Date: Wed, 21 Aug 2019 22:01:52 +0800 Subject: staging: erofs: detect potential multiref due to corrupted images As reported by erofs-utils fuzzer, currently, multiref (ondisk deduplication) hasn't been supported for now, we should forbid it properly. Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") Cc: # 4.19+ Signed-off-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20190821140152.229648-1-gaoxiang25@huawei.com Signed-off-by: Greg Kroah-Hartman --- drivers/staging/erofs/zdata.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/staging/erofs/zdata.c b/drivers/staging/erofs/zdata.c index 4d6faaab04f5..60d7c20db87d 100644 --- a/drivers/staging/erofs/zdata.c +++ b/drivers/staging/erofs/zdata.c @@ -798,6 +798,7 @@ static int z_erofs_decompress_pcluster(struct super_block *sb, for (i = 0; i < nr_pages; ++i) pages[i] = NULL; + err = 0; z_erofs_pagevec_ctor_init(&ctor, Z_EROFS_NR_INLINE_PAGEVECS, cl->pagevec, 0); @@ -819,8 +820,17 @@ static int z_erofs_decompress_pcluster(struct super_block *sb, pagenr = z_erofs_onlinepage_index(page); DBG_BUGON(pagenr >= nr_pages); - DBG_BUGON(pages[pagenr]); + /* + * currently EROFS doesn't support multiref(dedup), + * so here erroring out one multiref page. + */ + if (unlikely(pages[pagenr])) { + DBG_BUGON(1); + SetPageError(pages[pagenr]); + z_erofs_onlinepage_endio(pages[pagenr]); + err = -EFSCORRUPTED; + } pages[pagenr] = page; } z_erofs_pagevec_ctor_exit(&ctor, true); @@ -828,7 +838,6 @@ static int z_erofs_decompress_pcluster(struct super_block *sb, overlapped = false; compressed_pages = pcl->compressed_pages; - err = 0; for (i = 0; i < clusterpages; ++i) { unsigned int pagenr; @@ -852,7 +861,12 @@ static int z_erofs_decompress_pcluster(struct super_block *sb, pagenr = z_erofs_onlinepage_index(page); DBG_BUGON(pagenr >= nr_pages); - DBG_BUGON(pages[pagenr]); + if (unlikely(pages[pagenr])) { + DBG_BUGON(1); + SetPageError(pages[pagenr]); + z_erofs_onlinepage_endio(pages[pagenr]); + err = -EFSCORRUPTED; + } pages[pagenr] = page; overlapped = true; -- 2.23.0