From 5f3502945247f6315e58e207e86801fb6d53e133 Mon Sep 17 00:00:00 2001 From: Kinsey Moore Date: Thu, 16 Jan 2025 12:23:32 +0800 Subject: [PATCH 1/2] jffs2: Prevent rtime decompress memory corruption mainline inclusion from mainline-v6.12-rc3 commit fe051552f5078fa02d593847529a3884305a6ffe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHWWI CVE: CVE-2024-57850 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fe051552f5078fa02d593847529a3884305a6ffe -------------------------------- The rtime decompression routine does not fully check bounds during the entirety of the decompression pass and can corrupt memory outside the decompression buffer if the compressed data is corrupted. This adds the required check to prevent this failure mode. Cc: stable@vger.kernel.org Signed-off-by: Kinsey Moore Signed-off-by: Richard Weinberger Signed-off-by: Yongjian Sun --- fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c index 79e771ab624f..2b9ef713b844 100644 --- a/fs/jffs2/compr_rtime.c +++ b/fs/jffs2/compr_rtime.c @@ -95,6 +95,9 @@ static int jffs2_rtime_decompress(unsigned char *data_in, positions[value]=outpos; if (repeat) { + if ((outpos + repeat) >= destlen) { + return 1; + } if (backoffs + repeat >= outpos) { while(repeat) { cpage_out[outpos++] = cpage_out[backoffs++]; -- Gitee From 46e9ff263c1124127acccd632fb8775328087e78 Mon Sep 17 00:00:00 2001 From: Richard Weinberger Date: Thu, 16 Jan 2025 12:23:33 +0800 Subject: [PATCH 2/2] jffs2: Fix rtime decompressor mainline inclusion from mainline-v6.12-rc3 commit b29bf7119d6bbfd04aabb8d82b060fe2a33ef890 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHWWI CVE: CVE-2024-57850 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b29bf7119d6bbfd04aabb8d82b060fe2a33ef890 -------------------------------- The fix for a memory corruption contained a off-by-one error and caused the compressor to fail in legit cases. Cc: Kinsey Moore Cc: stable@vger.kernel.org Fixes: fe051552f5078 ("jffs2: Prevent rtime decompress memory corruption") Signed-off-by: Richard Weinberger Signed-off-by: Yongjian Sun --- fs/jffs2/compr_rtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c index 2b9ef713b844..3bd9d2f3bece 100644 --- a/fs/jffs2/compr_rtime.c +++ b/fs/jffs2/compr_rtime.c @@ -95,7 +95,7 @@ static int jffs2_rtime_decompress(unsigned char *data_in, positions[value]=outpos; if (repeat) { - if ((outpos + repeat) >= destlen) { + if ((outpos + repeat) > destlen) { return 1; } if (backoffs + repeat >= outpos) { -- Gitee