iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Jamie Iles 6d63cc42bb jffs2: Fix NULL pointer dereference in rp_size fs option parsing 
[ Upstream commit a61df3c413e49b0042f9caf774c58512d1cc71b7 ]

syzkaller found the following JFFS2 splat:

  Unable to handle kernel paging request at virtual address dfffa00000000001
  Mem abort info:
    ESR = 0x96000004
    EC = 0x25: DABT (current EL), IL = 32 bits
    SET = 0, FnV = 0
    EA = 0, S1PTW = 0
  Data abort info:
    ISV = 0, ISS = 0x00000004
    CM = 0, WnR = 0
  [dfffa00000000001] address between user and kernel address ranges
  Internal error: Oops: 96000004 [#1] SMP
  Dumping ftrace buffer:
     (ftrace buffer empty)
  Modules linked in:
  CPU: 0 PID: 12745 Comm: syz-executor.5 Tainted: G S                5.9.0-rc8+ #98
  Hardware name: linux,dummy-virt (DT)
  pstate: 20400005 (nzCv daif +PAN -UAO BTYPE=--)
  pc : jffs2_parse_param+0x138/0x308 fs/jffs2/super.c:206
  lr : jffs2_parse_param+0x108/0x308 fs/jffs2/super.c:205
  sp : ffff000022a57910
  x29: ffff000022a57910 x28: 0000000000000000
  x27: ffff000057634008 x26: 000000000000d800
  x25: 000000000000d800 x24: ffff0000271a9000
  x23: ffffa0001adb5dc0 x22: ffff000023fdcf00
  x21: 1fffe0000454af2c x20: ffff000024cc9400
  x19: 0000000000000000 x18: 0000000000000000
  x17: 0000000000000000 x16: ffffa000102dbdd0
  x15: 0000000000000000 x14: ffffa000109e44bc
  x13: ffffa00010a3a26c x12: ffff80000476e0b3
  x11: 1fffe0000476e0b2 x10: ffff80000476e0b2
  x9 : ffffa00010a3ad60 x8 : ffff000023b70593
  x7 : 0000000000000003 x6 : 00000000f1f1f1f1
  x5 : ffff000023fdcf00 x4 : 0000000000000002
  x3 : ffffa00010000000 x2 : 0000000000000001
  x1 : dfffa00000000000 x0 : 0000000000000008
  Call trace:
   jffs2_parse_param+0x138/0x308 fs/jffs2/super.c:206
   vfs_parse_fs_param+0x234/0x4e8 fs/fs_context.c:117
   vfs_parse_fs_string+0xe8/0x148 fs/fs_context.c:161
   generic_parse_monolithic+0x17c/0x208 fs/fs_context.c:201
   parse_monolithic_mount_data+0x7c/0xa8 fs/fs_context.c:649
   do_new_mount fs/namespace.c:2871 [inline]
   path_mount+0x548/0x1da8 fs/namespace.c:3192
   do_mount+0x124/0x138 fs/namespace.c:3205
   __do_sys_mount fs/namespace.c:3413 [inline]
   __se_sys_mount fs/namespace.c:3390 [inline]
   __arm64_sys_mount+0x164/0x238 fs/namespace.c:3390
   __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
   invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
   el0_svc_common.constprop.0+0x15c/0x598 arch/arm64/kernel/syscall.c:149
   do_el0_svc+0x60/0x150 arch/arm64/kernel/syscall.c:195
   el0_svc+0x34/0xb0 arch/arm64/kernel/entry-common.c:226
   el0_sync_handler+0xc8/0x5b4 arch/arm64/kernel/entry-common.c:236
   el0_sync+0x15c/0x180 arch/arm64/kernel/entry.S:663
  Code: d2d40001 f2fbffe1 91002260 d343fc02 (38e16841)
  ---[ end trace 4edf690313deda44 ]---

This is because since ec10a24f10c8, the option parsing happens before
fill_super and so the MTD device isn't associated with the filesystem.
Defer the size check until there is a valid association.

Fixes: ec10a24f10c8 ("vfs: Convert jffs2 to use the new mount API")
Cc: <stable@vger.kernel.org>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Jamie Iles <jamie@nuviainc.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-06 14:56:49 +01:00
..
9p
fs: 9p: add generic splice_write file operation
2020-12-01 21:40:47 +01:00
adfs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
affs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
afs
afs: Fix memory leak when mounting with multiple source parameters
2020-12-08 15:59:25 -08:00
autofs
autofs: harden ioctl table
2020-10-16 11:11:22 -07:00
befs
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
bfs
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
btrfs
btrfs: fix race when defragmenting leads to unnecessary IO
2020-12-30 11:54:13 +01:00
cachefiles
cachefiles: Handle readpage error correctly
2020-10-26 10:42:54 -07:00
ceph
ceph: fix race in concurrent __ceph_remove_cap invocations
2020-12-30 11:54:17 +01:00
cifs
SMB3.1.1: do not log warning message if server doesn't populate salt
2020-12-30 11:54:17 +01:00
coda
docs: filesystems: convert coda.txt to ReST
2020-05-05 09:22:21 -06:00
configfs
fs: configfs: delete repeated words in comments
2020-10-16 11:11:19 -07:00
cramfs
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
crypto
fscrypt: add fscrypt_is_nokey_name()
2020-12-26 16:02:43 +01:00
debugfs
debugfs: remove return value of debugfs_create_devm_seqfile()
2020-10-30 08:37:39 +01:00
devpts
…
dlm
networking changes for the 5.10 merge window
2020-10-15 18:42:13 -07:00
ecryptfs
mm, treewide: rename kzfree() to kfree_sensitive()
2020-08-07 11:33:22 -07:00
efivarfs
efivarfs: revert "fix memory leak in efivarfs_create()"
2020-11-25 16:55:02 +01:00
efs
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
erofs
erofs: avoid using generic_block_bmap
2020-12-30 11:53:46 +01:00
exfat
exfat: Avoid allocating upcase table using kcalloc()
2020-12-26 16:02:38 +01:00
exportfs
…
ext2
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
ext4
ext4: don't remount read-only with errors=continue on reboot
2020-12-30 11:54:13 +01:00
f2fs
f2fs: fix double free of unicode map
2020-12-30 11:53:31 +01:00
fat
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
freevxfs
…
fscache
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2020-06-03 16:27:18 -07:00
fuse
virtiofs fix leak in setup
2020-12-30 11:53:08 +01:00
gfs2
gfs2: Fix deadlock between gfs2_{create_inode,inode_lookup} and delete_work_func
2020-12-01 00:21:10 +01:00
hfs
fs: Replace zero-length array with flexible-array member
2020-10-29 17:22:59 -05:00
hfsplus
fs: Replace zero-length array with flexible-array member
2020-10-29 17:22:59 -05:00
hostfs
…
hpfs
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
hugetlbfs
hugetlbfs: prevent filesystem stacking of hugetlbfs
2020-08-12 10:57:56 -07:00
iomap
iomap: clean up writeback state logic on writepage error
2020-11-04 08:52:46 -08:00
isofs
fs: Replace zero-length array with flexible-array member
2020-10-29 17:22:59 -05:00
jbd2
jbd2: fix kernel-doc markups
2020-11-19 22:38:29 -05:00
jffs2
jffs2: Fix NULL pointer dereference in rp_size fs option parsing
2021-01-06 14:56:49 +01:00
jfs
jfs: Fix array index bounds check in dbAdjTree
2020-12-30 11:54:18 +01:00
kernfs
fsnotify: pass dir and inode arguments to fsnotify()
2020-07-27 23:15:48 +02:00
lockd
lockd: don't use interval-based rebinding over TCP
2020-12-30 11:53:30 +01:00
minix
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
nfs
NFS/pNFS: Fix a typo in ff_layout_resend_pnfs_read()
2020-12-30 11:53:57 +01:00
nfs_common
nfs_common: need lock during iterate through the list
2020-12-30 11:53:45 +01:00
nfsd
fsnotify: generalize handle_inode_event()
2020-12-30 11:54:18 +01:00
nilfs2
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
nls
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
notify
fsnotify: fix events reported to watching parent and child
2020-12-30 11:54:18 +01:00
ntfs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
ocfs2
ocfs2: initialize ip_next_orphan
2020-11-14 11:26:04 -08:00
omfs
fs: omfs: use kmemdup() rather than kmalloc+memcpy
2020-09-22 23:39:45 -04:00
openpromfs
…
orangefs
orangefs: remove unnecessary assignment to variable ret
2020-08-04 15:01:58 -04:00
overlayfs
ovl: make ioctl() safe
2020-12-30 11:54:16 +01:00
proc
proc: fix lookup in /proc/net subdirectories after setns(2)
2020-12-30 11:53:56 +01:00
pstore
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
qnx4
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
qnx6
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
quota
fs: quota: fix array-index-out-of-bounds bug by passing correct argument to vfs_cleanup_quota_inode()
2020-12-26 16:02:45 +01:00
ramfs
ramfs: fix nommu mmap with gaps in the page cache
2020-10-16 11:11:22 -07:00
reiserfs
reiserfs: Fix oops during mount
2020-10-01 11:15:31 +02:00
romfs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
squashfs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
sysfs
sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output
2020-10-02 12:02:30 +02:00
sysv
[PATCH] reduce boilerplate in fsid handling
2020-09-18 16:45:50 -04:00
tracefs
…
ubifs
ubifs: wbuf: Don't leak kernel memory to flash
2020-12-30 11:54:17 +01:00
udf
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
ufs
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
unicode
unicode: Add utf8_casefold_hash
2020-09-10 14:03:31 -07:00
vboxsf
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2020-10-15 15:11:56 -07:00
verity
fs-verity: use smp_load_acquire() for ->i_verity_info
2020-07-21 16:02:41 -07:00
xfs
xfs: revert "xfs: fix rmap key and record comparison functions"
2020-11-19 15:17:50 -08:00
zonefs
zonefs: fix page reference and BIO leak
2020-12-10 15:14:19 +09:00
aio.c
vfs: separate __sb_start_write into blocking and non-blocking helpers
2020-11-10 16:53:07 -08:00
anon_inodes.c
…
attr.c
…
bad_inode.c
fs: move the fiemap definitions out of fs.h
2020-06-03 23:16:55 -04:00
binfmt_aout.c
exec: Rename flush_old_exec begin_new_exec
2020-05-07 16:55:47 -05:00
binfmt_elf_fdpic.c
binfmt_elf, binfmt_elf_fdpic: use a VMA list snapshot
2020-10-16 11:11:21 -07:00
binfmt_elf.c
fs: Replace zero-length array with flexible-array member
2020-10-29 17:22:59 -05:00
binfmt_em86.c
Merge branch 'akpm' (patches from Andrew)
2020-06-04 19:18:29 -07:00
binfmt_flat.c
binfmt_flat: revert "binfmt_flat: don't offset the data start"
2020-08-24 08:49:13 +10:00
binfmt_misc.c
Merge branch 'akpm' (patches from Andrew)
2020-06-04 19:18:29 -07:00
binfmt_script.c
Merge branch 'akpm' (patches from Andrew)
2020-06-04 19:18:29 -07:00
block_dev.c
block: add a bdget_part helper
2020-10-05 10:38:33 -06:00
buffer.c
mm, memcg: rework remote charging API to support nesting
2020-10-18 09:27:09 -07:00
char_dev.c
vfs: allow unprivileged whiteout creation
2020-05-14 16:44:23 +02:00
compat_binfmt_elf.c
Split the old READ_IMPLIES_EXEC workaround from executable PT_GNU_STACK
2020-06-05 13:45:21 -07:00
coredump.c
coredump: fix core_pattern parse error
2020-12-06 10:19:07 -08:00
d_path.c
fs: fix NULL dereference due to data race in prepend_path()
2020-10-14 14:54:45 -07:00
dax.c
fuse update for 5.10
2020-10-19 14:28:30 -07:00
dcache.c
vfs: Use sequence counter with associated spinlock
2020-07-29 16:14:27 +02:00
dcookies.c
…
direct-io.c
\n
2020-10-15 15:03:10 -07:00
drop_caches.c
sysctl: pass kernel pointers to ->proc_handler
2020-04-27 02:07:40 -04:00
eventfd.c
eventfd: convert to f_op->read_iter()
2020-05-06 22:33:43 -04:00
eventpoll.c
epoll: check for events when removing a timed out thread from the wait queue
2020-12-30 11:54:00 +01:00
exec.c
powerpc updates for 5.10
2020-10-16 12:21:15 -07:00
fcntl.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
fhandle.c
…
file_table.c
task_work: cleanup notification modes
2020-10-17 15:05:30 -06:00
file.c
io_uring: don't rely on weak ->files references
2020-09-30 20:32:32 -06:00
filesystems.c
…
fs_context.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
fs_parser.c
fs_parse: mark fs_param_bad_value() as static
2020-10-13 18:38:27 -07:00
fs_pin.c
…
fs_struct.c
vfs: Use sequence counter with associated spinlock
2020-07-29 16:14:27 +02:00
fs_types.c
…
fs-writeback.c
block-5.10-2020-10-12
2020-10-13 12:12:44 -07:00
fsopen.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
init.c
init: add an init_dup helper
2020-08-04 21:02:38 -04:00
inode.c
fs: Handle I_DONTCACHE in iput_final() instead of generic_drop_inode()
2020-12-30 11:53:49 +01:00
internal.h
fs: remove compat_sys_mount
2020-09-22 23:45:57 -04:00
io_uring.c
io_uring: close a small race gap for files cancel
2021-01-06 14:56:49 +01:00
io-wq.c
io-wq: cancel request if it's asking for files and we don't have them
2020-11-04 10:22:56 -07:00
io-wq.h
io_uring: fix io_wqe->work_list corruption
2020-12-30 11:54:03 +01:00
ioctl.c
fs: remove ksys_ioctl
2020-07-31 08:16:01 +02:00
Kconfig
tmpfs: support 64-bit inums per-sb
2020-08-07 11:33:24 -07:00
Kconfig.binfmt
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
kernel_read_file.c
fs/kernel_file_read: Add "offset" arg for partial reads
2020-10-05 13:37:04 +02:00
libfs.c
libfs: fix error cast of negative value in simple_attr_write()
2020-11-22 10:48:22 -08:00
locks.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
Makefile
Refactored code for 5.10:
2020-10-23 11:33:41 -07:00
mbcache.c
…
mount.h
proc/mounts: add cursor
2020-05-14 16:44:24 +02:00
mpage.c
fs: convert mpage_readpages to mpage_readahead
2020-06-02 10:59:07 -07:00
namei.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
namespace.c
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-24 12:26:05 -07:00
no-block.c
…
nsfs.c
nsproxy: attach to namespaces via pidfds
2020-05-13 11:41:22 +02:00
open.c
openat2: reject RESOLVE_BENEATH|RESOLVE_IN_ROOT
2020-12-30 11:54:24 +01:00
pipe.c
Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-10-11 11:11:35 -07:00
pnode.c
propagate_one(): mnt_set_mountpoint() needs mount_lock
2020-04-27 10:37:14 -04:00
pnode.h
…
posix_acl.c
vfs: clean up posix_acl_permission() logic aroudn MAY_NOT_BLOCK
2020-06-08 11:04:19 -07:00
proc_namespace.c
proc mountinfo: make splice available again
2020-12-30 11:54:02 +01:00
read_write.c
Refactored code for 5.10:
2020-10-23 11:33:41 -07:00
readdir.c
fs: remove ksys_getdents64
2020-07-31 08:16:00 +02:00
remap_range.c
vfs: move the remap range helpers to remap_range.c
2020-10-15 09:48:49 -07:00
select.c
fs: Replace zero-length array with flexible-array member
2020-10-29 17:22:59 -05:00
seq_file.c
fix return values of seq_read_iter()
2020-11-15 22:12:53 -05:00
signalfd.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
splice.c
io_uring-5.10-2020-10-24
2020-10-24 12:40:18 -07:00
stack.c
…
stat.c
fs: remove KSTAT_QUERY_FLAGS
2020-09-26 22:55:05 -04:00
statfs.c
Add a "nosymfollow" mount option.
2020-08-27 16:06:47 -04:00
super.c
vfs: move __sb_{start,end}_write* to fs.h
2020-11-10 16:53:11 -08:00
sync.c
overlayfs update for 5.8
2020-06-09 15:40:50 -07:00
timerfd.c
…
userfaultfd.c
mm: remove the now-unnecessary mmget_still_valid() hack
2020-10-16 11:11:22 -07:00
utimes.c
fs: expose utimes_common
2020-07-31 08:16:01 +02:00
xattr.c
fs/xattr.c: fix kernel-doc warnings for setxattr & removexattr
2020-10-13 18:38:27 -07:00