From: Gao Xiang <hsiangkao@xxxxxxxxxxxxxxxxx> commit 0005e01e1e875c5e27130c5e2ed0189749d1e08a upstream. If z_erofs_gbuf_growsize() partially fails on a global buffer due to memory allocation failure or fault injection (as reported by syzbot [1]), new pages need to be freed by comparing to the existing pages to avoid memory leaks. However, the old gbuf->pages[] array may not be large enough, which can lead to null-ptr-deref or out-of-bound access. Fix this by checking against gbuf->nrpages in advance. [1] https://lore.kernel.org/r/000000000000f7b96e062018c6e3@xxxxxxxxxx Reported-by: syzbot+242ee56aaa9585553766@xxxxxxxxxxxxxxxxxxxxxxxxx Fixes: d6db47e571dc ("erofs: do not use pagepool in z_erofs_gbuf_growsize()") Cc: <stable@xxxxxxxxxxxxxxx> # 6.10+ Reviewed-by: Chunhai Guo <guochunhai@xxxxxxxx> Reviewed-by: Sandeep Dhavale <dhavale@xxxxxxxxxx> Signed-off-by: Gao Xiang <hsiangkao@xxxxxxxxxxxxxxxxx> Link: https://lore.kernel.org/r/20240820085619.1375963-1-hsiangkao@xxxxxxxxxxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/erofs/zutil.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/erofs/zutil.c +++ b/fs/erofs/zutil.c @@ -111,7 +111,8 @@ int z_erofs_gbuf_growsize(unsigned int n out: if (i < z_erofs_gbuf_count && tmp_pages) { for (j = 0; j < nrpages; ++j) - if (tmp_pages[j] && tmp_pages[j] != gbuf->pages[j]) + if (tmp_pages[j] && (j >= gbuf->nrpages || + tmp_pages[j] != gbuf->pages[j])) __free_page(tmp_pages[j]); kfree(tmp_pages); } Patches currently in stable-queue which might be from hsiangkao@xxxxxxxxxxxxxxxxx are queue-6.10/erofs-fix-out-of-bound-access-when-z_erofs_gbuf_growsize-partially-fails.patch
