NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
3,366 Commits 59 Branches 0 Tags 1.5 GiB
C 97.1%
Assembly 1.6%
C++ 0.6%
Makefile 0.3%
Perl 0.1%
Go to file
Zhe Li 3749e91505 jffs2: fix UAF problem 
[ Upstream commit 798b7347e4f29553db4b996393caf12f5b233daf ]

The log of UAF problem is listed below.
BUG: KASAN: use-after-free in jffs2_rmdir+0xa4/0x1cc [jffs2] at addr c1f165fc
Read of size 4 by task rm/8283
=============================================================================
BUG kmalloc-32 (Tainted: P    B      O   ): kasan: bad access detected
-----------------------------------------------------------------------------

INFO: Allocated in 0xbbbbbbbb age=3054364 cpu=0 pid=0
        0xb0bba6ef
        jffs2_write_dirent+0x11c/0x9c8 [jffs2]
        __slab_alloc.isra.21.constprop.25+0x2c/0x44
        __kmalloc+0x1dc/0x370
        jffs2_write_dirent+0x11c/0x9c8 [jffs2]
        jffs2_do_unlink+0x328/0x5fc [jffs2]
        jffs2_rmdir+0x110/0x1cc [jffs2]
        vfs_rmdir+0x180/0x268
        do_rmdir+0x2cc/0x300
        ret_from_syscall+0x0/0x3c
INFO: Freed in 0x205b age=3054364 cpu=0 pid=0
        0x2e9173
        jffs2_add_fd_to_list+0x138/0x1dc [jffs2]
        jffs2_add_fd_to_list+0x138/0x1dc [jffs2]
        jffs2_garbage_collect_dirent.isra.3+0x21c/0x288 [jffs2]
        jffs2_garbage_collect_live+0x16bc/0x1800 [jffs2]
        jffs2_garbage_collect_pass+0x678/0x11d4 [jffs2]
        jffs2_garbage_collect_thread+0x1e8/0x3b0 [jffs2]
        kthread+0x1a8/0x1b0
        ret_from_kernel_thread+0x5c/0x64
Call Trace:
[c17ddd20] [c02452d4] kasan_report.part.0+0x298/0x72c (unreliable)
[c17ddda0] [d2509680] jffs2_rmdir+0xa4/0x1cc [jffs2]
[c17dddd0] [c026da04] vfs_rmdir+0x180/0x268
[c17dde00] [c026f4e4] do_rmdir+0x2cc/0x300
[c17ddf40] [c001a658] ret_from_syscall+0x0/0x3c

The root cause is that we don't get "jffs2_inode_info.sem" before
we scan list "jffs2_inode_info.dents" in function jffs2_rmdir.
This patch add codes to get "jffs2_inode_info.sem" before we scan
"jffs2_inode_info.dents" to slove the UAF problem.

Signed-off-by: Zhe Li <lizhe67@huawei.com>
Reviewed-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2021-03-16 16:34:33 +08:00
Documentation kbuild: support LLVM=1 to switch the default tools to Clang/LLVM 2021-03-16 16:34:25 +08:00
LICENSES Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
arch m68knommu: fix overwriting of bits in ColdFire V3 cache control 2021-03-16 16:34:32 +08:00
block iocost: Fix check condition of iocg abs_vdebt 2021-03-16 16:33:18 +08:00
certs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
crypto crypto: algif_aead - fix uninitialized ctx->init 2021-03-16 16:34:22 +08:00
drivers drm/ttm: fix offset in VMAs with a pg_offs in ttm_bo_vm_access 2021-03-16 16:34:32 +08:00
fs jffs2: fix UAF problem 2021-03-16 16:34:33 +08:00
include iommu/vt-d: Enforce PASID devTLB field mask 2021-03-16 16:34:16 +08:00
init x86: Fix early boot crash on gcc-10, third try 2021-03-16 16:28:02 +08:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2021-03-16 16:27:51 +08:00
kernel kthread: Do not preempt current task if it is going to call schedule() 2021-03-16 16:34:30 +08:00
lib test_kmod: avoid potential double free in trigger_config_run_type() 2021-03-16 16:34:21 +08:00
mm mm, page_alloc: fix core hung in free_pcppages_bulk() 2021-03-16 16:34:29 +08:00
net svcrdma: Fix another Receive buffer leak 2021-03-16 16:34:32 +08:00
package config/arm64: OPEN CONFIG_PSI and phytium configs 2021-03-16 11:02:59 +08:00
samples bpf: Fix fds_example SIGSEGV error 2021-03-16 16:33:24 +08:00
scripts recordmcount: Fix build failure on non arm64 2021-03-16 16:34:19 +08:00
security Smack: prevent underflow in smk_set_cipso() 2021-03-16 16:33:40 +08:00
sound ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion 2021-03-16 16:34:27 +08:00
tools perf probe: Fix memory leakage when the probe point is not found 2021-03-16 16:34:26 +08:00
usr Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
virt KVM: arm64: Don't inherit exec permission across page-table levels 2021-03-16 16:32:57 +08:00
.clang-format Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.cocciconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.get_maintainer.ignore Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.gitattributes Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.gitignore Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
COPYING Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
CREDITS Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kbuild Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
MAINTAINERS Documentation/llvm: add documentation on building w/ Clang/LLVM 2021-03-16 16:34:24 +08:00
Makefile kbuild: support LLVM=1 to switch the default tools to Clang/LLVM 2021-03-16 16:34:25 +08:00
README Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
README.md Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
backport_remove_lists.txt Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tools_key.pub Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00

README.md

Tencent Linux Kernel 4.0