No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Ryusuke Konishi 09d6d05579 nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
commit 985ebec4ab0a28bb5910c3b1481a40fbf7f9e61d upstream.

Syzbot reported that when searching for records in a directory where the
inode's i_size is corrupted and has a large value, memory access outside
the folio/page range may occur, or a use-after-free bug may be detected if
KASAN is enabled.

This is because nilfs_last_byte(), which is called by nilfs_find_entry()
and others to calculate the number of valid bytes of directory data in a
page from i_size and the page index, loses the upper 32 bits of the 64-bit
size information due to an inappropriate type of local variable to which
the i_size value is assigned.

This caused a large byte offset value due to underflow in the end address
calculation in the calling nilfs_find_entry(), resulting in memory access
that exceeds the folio/page size.

Fix this issue by changing the type of the local variable causing the bit
loss from "unsigned int" to "u64".  The return value of nilfs_last_byte()
is also of type "unsigned int", but it is truncated so as not to exceed
PAGE_SIZE and no bit loss occurs, so no change is required.

Link: https://lkml.kernel.org/r/20241119172403.9292-1-konishi.ryusuke@gmail.com
Fixes: 2ba466d74e ("nilfs2: directory entry operations")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+96d5d14c47d97015c624@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=96d5d14c47d97015c624
Tested-by: syzbot+96d5d14c47d97015c624@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-14 19:44:49 +01:00
arch crypto: x86/aegis128 - access 32-bit arguments as 32-bit 2024-12-14 19:44:47 +01:00
block block: fix ordering between checking BLK_MQ_S_STOPPED request adding 2024-12-14 19:44:38 +01:00
certs
crypto crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY 2024-12-14 19:44:23 +01:00
Documentation dt-bindings: clock: axi-clkgen: include AXI clk 2024-12-14 19:44:30 +01:00
drivers scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt 2024-12-14 19:44:49 +01:00
fs nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() 2024-12-14 19:44:49 +01:00
include xen/xenbus: fix locking 2024-12-14 19:44:47 +01:00
init initramfs: avoid filename buffer overrun 2024-12-14 19:44:21 +01:00
ipc
kernel tracing: Fix cmp_entries_dup() to respect sort() comparison rules 2024-12-14 19:44:48 +01:00
lib lib: string_helpers: silence snprintf() output truncation warning 2024-12-14 19:44:39 +01:00
LICENSES
mm mm: revert "mm: shmem: fix data-race in shmem_getattr()" 2024-12-14 19:44:19 +01:00
net tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg 2024-12-14 19:44:47 +01:00
samples bpf: Fix the xdp_adjust_tail sample prog issue 2024-12-14 19:44:26 +01:00
scripts modpost: remove incorrect code in do_eisa_entry() 2024-12-14 19:44:41 +01:00
security apparmor: fix 'Do simple duplicate message elimination' 2024-12-14 19:44:34 +01:00
sound ASoC: fsl_micfil: fix the naming style for mask definition 2024-12-14 19:44:42 +01:00
tools perf trace: Avoid garbage when not printing a syscall's arguments 2024-12-14 19:44:32 +01:00
usr
virt KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() 2024-11-08 16:20:47 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Remove *.orig pattern from .gitignore 2024-11-08 16:20:33 +01:00
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.286 2024-11-17 14:58:53 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.