From 9aa81fd4648f4896cc1bf7404e34ccd0714a2ae2 Mon Sep 17 00:00:00 2001 From: Kinsey Moore Date: Thu, 16 Jan 2025 12:23:50 +0800 Subject: [PATCH 1/2] jffs2: Prevent rtime decompress memory corruption mainline inclusion from mainline-v6.12-rc3 commit fe051552f5078fa02d593847529a3884305a6ffe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHWWI CVE: CVE-2024-57850 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fe051552f5078fa02d593847529a3884305a6ffe -------------------------------- The rtime decompression routine does not fully check bounds during the entirety of the decompression pass and can corrupt memory outside the decompression buffer if the compressed data is corrupted. This adds the required check to prevent this failure mode. Cc: stable@vger.kernel.org Signed-off-by: Kinsey Moore Signed-off-by: Richard Weinberger Signed-off-by: Yongjian Sun --- fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c index 79e771ab624f..2b9ef713b844 100644 --- a/fs/jffs2/compr_rtime.c +++ b/fs/jffs2/compr_rtime.c @@ -95,6 +95,9 @@ static int jffs2_rtime_decompress(unsigned char *data_in, positions[value]=outpos; if (repeat) { + if ((outpos + repeat) >= destlen) { + return 1; + } if (backoffs + repeat >= outpos) { while(repeat) { cpage_out[outpos++] = cpage_out[backoffs++]; -- Gitee From aadf96ea22c82719b9328da062b3ed27fda23f4e Mon Sep 17 00:00:00 2001 From: Richard Weinberger Date: Thu, 16 Jan 2025 12:23:51 +0800 Subject: [PATCH 2/2] jffs2: Fix rtime decompressor mainline inclusion from mainline-v6.12-rc3 commit b29bf7119d6bbfd04aabb8d82b060fe2a33ef890 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHWWI CVE: CVE-2024-57850 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b29bf7119d6bbfd04aabb8d82b060fe2a33ef890 -------------------------------- The fix for a memory corruption contained a off-by-one error and caused the compressor to fail in legit cases. Cc: Kinsey Moore Cc: stable@vger.kernel.org Fixes: fe051552f5078 ("jffs2: Prevent rtime decompress memory corruption") Signed-off-by: Richard Weinberger Signed-off-by: Yongjian Sun --- fs/jffs2/compr_rtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c index 2b9ef713b844..3bd9d2f3bece 100644 --- a/fs/jffs2/compr_rtime.c +++ b/fs/jffs2/compr_rtime.c @@ -95,7 +95,7 @@ static int jffs2_rtime_decompress(unsigned char *data_in, positions[value]=outpos; if (repeat) { - if ((outpos + repeat) >= destlen) { + if ((outpos + repeat) > destlen) { return 1; } if (backoffs + repeat >= outpos) { -- Gitee