CVE-2022-50743

In the Linux kernel, the following vulnerability has been resolved:

erofs: Fix pcluster memleak when its block address is zero

syzkaller reported a memleak: https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed

unreferenced object 0xffff88811009c7f8 (size 136): … backtrace: [] z_erofs_do_read_page+0x99b/0x1740 [] z_erofs_readahead+0x24e/0x580 [] read_pages+0x86/0x3d0 …

syzkaller constructed a case: in z_erofs_register_pcluster(), ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index be zero although pcl is not a inline pcluster.

Then following path adds refcount for grp, but the refcount wont be put because pcl is inline.

z_erofs_readahead() z_erofs_do_read_page() # for another page z_erofs_collector_begin() erofs_find_workgroup() erofs_workgroup_get()

Since its illegal for the block address of a non-inlined pcluster to be zero, add check here to avoid registering the pcluster which would be leaked.

Affected Software

References

• https://git.kernel.org/stable/c/618e712b99c78d1004b70a1a9ab0a4830d0b2673
• https://git.kernel.org/stable/c/ac54c1f7b288d83b6ba1e320efff24ecc21309cd
• https://git.kernel.org/stable/c/c42c0ffe81176940bd5dead474216b7198d77675