Gao Xiang 0005e01e1e erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails ... If z_erofs_gbuf_growsize() partially fails on a global buffer due to memory allocation failure or fault injection (as reported by syzbot [1]), new pages need to be freed by comparing to the existing pages to avoid memory leaks. However, the old gbuf->pages[] array may not be large enough, which can lead to null-ptr-deref or out-of-bound access. Fix this by checking against gbuf->nrpages in advance. [1] https://lore.kernel.org/r/000000000000f7b96e062018c6e3@google.com Reported-by: syzbot+242ee56aaa9585553766@syzkaller.appspotmail.com Fixes: d6db47e571 ("erofs: do not use pagepool in z_erofs_gbuf_growsize()") Cc: <stable@vger.kernel.org> # 6.10+ Reviewed-by: Chunhai Guo <guochunhai@vivo.com> Reviewed-by: Sandeep Dhavale <dhavale@google.com> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> Link: https://lore.kernel.org/r/20240820085619.1375963-1-hsiangkao@linux.alibaba.com		2024-08-21 08:12:05 +08:00
..
compress.h	erofs: avoid refcounting short-lived pages	2024-07-11 15:14:26 +08:00
data.c	erofs: support multi-page folios for erofs_bread()	2024-07-26 18:47:57 +08:00
decompressor.c	erofs: avoid refcounting short-lived pages	2024-07-11 15:14:26 +08:00
decompressor_deflate.c	erofs: tidy up stream decompressors	2024-07-09 19:04:41 +08:00
decompressor_lzma.c	erofs: convert comma to semicolon	2024-07-26 18:48:12 +08:00
decompressor_zstd.c	erofs: tidy up stream decompressors	2024-07-09 19:04:41 +08:00
dir.c	erofs: simplify readdir operation	2024-08-19 11:06:20 +08:00
erofs_fs.h	erofs: Zstandard compression support	2024-05-09 07:46:56 +08:00
fscache.c	erofs: don't align offset for erofs_read_metabuf() (simple cases)	2024-05-18 01:47:26 +08:00
inode.c	erofs: allow large folios for compressed files	2024-08-19 16:10:04 +08:00
internal.h	erofs: simplify readdir operation	2024-08-19 11:06:20 +08:00
Kconfig	erofs: Zstandard compression support	2024-05-09 07:46:56 +08:00
Makefile	erofs: Zstandard compression support	2024-05-09 07:46:56 +08:00
namei.c	erofs_buf: store address_space instead of inode	2024-04-25 00:57:14 -04:00
super.c	erofs: get rid of check_layout_compatibility()	2024-08-19 11:06:20 +08:00
sysfs.c	erofs: make kobj_type structures constant	2023-02-15 08:11:26 +08:00
xattr.c	erofs_buf: store address_space instead of inode	2024-04-25 00:57:14 -04:00
xattr.h	erofs: move erofs_xattr_handlers and xattr_handler_map to .rodata	2023-10-09 16:24:17 +02:00
zdata.c	erofs: silence uninitialized variable warning in z_erofs_scan_folio()	2024-07-13 12:47:34 +08:00
zmap.c	erofs: get rid of z_erofs_map_blocks_iter_* tracepoints	2024-07-10 18:57:06 +08:00
zutil.c	erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails	2024-08-21 08:12:05 +08:00