Unverified Commit 259b1112 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15500 Fix 4 CVEs in JFFS2 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Zhaolong <wangzhaolong1@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/KBVLDBWC7D7PMJFAOZLBLQBLQS6V3MEL/ 
CVE-2022-49381
CVE-2022-49277
CVE-2022-49276
CVE-2021-47656

Baokun Li (4):
  jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
  jffs2: fix memory leak in jffs2_scan_medium
  jffs2: fix memory leak in jffs2_do_mount_fs
  jffs2: fix memory leak in jffs2_do_fill_super

 
https://gitee.com/src-openeuler/kernel/issues/IBP4D9
https://gitee.com/src-openeuler/kernel/issues/IBP6XT
https://gitee.com/src-openeuler/kernel/issues/IBP66Z
https://gitee.com/src-openeuler/kernel/issues/IBP724 
 
Link:https://gitee.com/openeuler/kernel/pulls/15500

 

Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 698baeae 273fba4e

fs/jffs2/build.c

+3 −1
Original line number Diff line number Diff line
@@ -415,13 +415,15 @@ int jffs2_do_mount_fs(struct jffs2_sb_info *c) 
		jffs2_free_ino_caches(c);

		jffs2_free_raw_node_refs(c);

		ret = -EIO;

		goto out_free;

		goto out_sum_exit;

	}



	jffs2_calc_trigger_levels(c);



	return 0;



 out_sum_exit:

	jffs2_sum_exit(c);

 out_free:

	kvfree(c->blocks);

fs/jffs2/fs.c

+2 −1
Original line number Diff line number Diff line
@@ -597,8 +597,9 @@ int jffs2_do_fill_super(struct super_block *sb, void *data, int silent) 
	jffs2_free_ino_caches(c);

	jffs2_free_raw_node_refs(c);

	kvfree(c->blocks);

 out_inohash:

	jffs2_clear_xattr_subsystem(c);

	jffs2_sum_exit(c);

 out_inohash:

	kfree(c->inocache_list);

 out_wbuf:

	jffs2_flash_cleanup(c);

fs/jffs2/scan.c

+4 −2
Original line number Diff line number Diff line
@@ -136,7 +136,7 @@ int jffs2_scan_medium(struct jffs2_sb_info *c) 
		if (!s) {

			JFFS2_WARNING("Can't allocate memory for summary\n");

			ret = -ENOMEM;

			goto out;

			goto out_buf;

		}

	}
@@ -274,13 +274,15 @@ int jffs2_scan_medium(struct jffs2_sb_info *c) 
	}

	ret = 0;

 out:

	jffs2_sum_reset_collected(s);

	kfree(s);

 out_buf:

	if (buf_size)

		kfree(flashbuf);

#ifndef __ECOS

	else

		mtd_unpoint(c->mtd, 0, c->mtd->size);

#endif

	kfree(s);

	return ret;

}