CVE-2022-50743: erofs: Fix pcluster memleak when its block address is zero
In the Linux kernel, the following vulnerability has been resolved:
erofs: Fix pcluster memleak when its block address is zero
syzkaller reported a memleak: https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed
unreferenced object 0xffff88811009c7f8 (size 136): ... backtrace: [<ffffffff821db19b>] zerofsdoreadpage+0x99b/0x1740 [<ffffffff821dee9e>] zerofsreadahead+0x24e/0x580 [<ffffffff814bc0d6>] readpages+0x86/0x3d0 ...
syzkaller constructed a case: in zerofsregisterpcluster(), ztailpacking = false and map->mpa = zero. This makes pcl->obj.index be zero although pcl is not a inline pcluster.
Then following path adds refcount for grp, but the refcount won't be put because pcl is inline.
zerofsreadahead() zerofsdoreadpage() # for another page zerofscollectorbegin() erofsfindworkgroup() erofsworkgroupget()
Since it's illegal for the block address of a non-inlined pcluster to be zero, add check here to avoid registering the pcluster which would be leaked.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.4-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.0.16 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1