From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-112.freemail.mail.aliyun.com (out30-112.freemail.mail.aliyun.com [115.124.30.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2D8418B493; Tue, 20 Aug 2024 09:27:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.112 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724146042; cv=none; b=RmjN9QDN2U8NJBiDFn00B9D/YbE7fBQuphCLx4du8nFTSNrKt9RX4Ai/sghhBZ6mwuAPUKaJ0JU2K8eMp4+pvV0DK9O1Rdk4cqYecKbitumnfnRlTVY0Ru05Z1FHRkk4cqklk9kDYG3JxXfQRp88VguYdU4oHEC26iot30zfYK4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1724146042; c=relaxed/simple; bh=VMIkaESEWnZtDu7m61lJYnpAx8RNEOmQg402P4Akm3w=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=YeqzxFxq07VSAaMpyGnn0A+DjicsjtvQpZBp5dw8GEI2N4tUsZ5DvnkodHfBaniNHdT7alreBRh68qxn9NFchWX5nYbvhUClzazIUlafNOqvRMROVgKxdgRye6pW4tzxFsCZ71dCfe6w8NGxcfhE2eX3F/Cypn5S7jzTRDoSae0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=k0IXrelx; arc=none smtp.client-ip=115.124.30.112 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="k0IXrelx" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1724146035; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=K/MrWzNIyumOIgtjq7Sac1rrkPi5s2Cv9Be/ma9e4Xg=; b=k0IXrelxmKRJmwnTssi86tnRrzrTC0XsMzQIQC45m8hpjPd9qF5456Md8lKV7+K80GriVGdl4oZdRijsMolIMBVn+PMWQvUevvOK1ORfXf3L58qMv8TYpe4qD+bwWcgFjzQpnLZ5x2WsMjpxa+yg/dJym+dVfiez1s2EywBWcGs= Received: from 30.221.130.129(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0WDI3ajq_1724146033) by smtp.aliyun-inc.com; Tue, 20 Aug 2024 17:27:14 +0800 Message-ID: Date: Tue, 20 Aug 2024 17:27:13 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails To: Chunhai Guo , "linux-erofs@lists.ozlabs.org" Cc: LKML , "stable@vger.kernel.org" References: <000000000000f7b96e062018c6e3@google.com> <20240820084224.1362129-1-hsiangkao@linux.alibaba.com> <8481ec6f-9f8a-4f76-8ab7-b45e38cc8d40@vivo.com> From: Gao Xiang In-Reply-To: <8481ec6f-9f8a-4f76-8ab7-b45e38cc8d40@vivo.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi Chunhai, On 2024/8/20 17:25, Chunhai Guo wrote: > 在 2024/8/20 16:42, Gao Xiang 写道: >> If z_erofs_gbuf_growsize() partially fails on a global buffer due to >> memory allocation failure or fault injection (as reported by syzbot [1]), >> new pages need to be freed by comparing to the existing pages to avoid >> memory leaks. >> >> However, the old gbuf->pages[] array may not be large enough, which can >> lead to null-ptr-deref or out-of-bound access. >> >> Fix this by checking against gbuf->nrpages in advance. >> >> Fixes: d6db47e571dc ("erofs: do not use pagepool in z_erofs_gbuf_growsize()") >> Cc: # 6.10+ >> Cc: Chunhai Guo >> Signed-off-by: Gao Xiang >> > Reviewed-by: Chunhai Guo I've sent a patch to add links and reported-by. I assume I can add your reviewed-by to that version too? Thanks, Gao Xiang > > Thanks, > > Chunhai Guo >