In the Linux kernel, the following vulnerability has been resolved:
jffs2: fix memory leak in jffs2dofill_super
If jffs2iget() or dmakeroot() in jffs2dofillsuper() returns an error, we can observe the following kmemleak report:
unreferenced object 0xffff888105a65340 (size 64): comm "mount", pid 710, jiffies 4302851558 (age 58.239s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff859c45e5>] kmemcachealloctrace+0x475/0x8a0 [<ffffffff86160146>] jffs2suminit+0x96/0x1a0 [<ffffffff86140e25>] jffs2domountfs+0x745/0x2120 [<ffffffff86149fec>] jffs2dofillsuper+0x35c/0x810 [<ffffffff8614aae9>] jffs2fillsuper+0x2b9/0x3b0 [...] unreferenced object 0xffff8881bd7f0000 (size 65536): comm "mount", pid 710, jiffies 4302851558 (age 58.239s) hex dump (first 32 bytes): bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ backtrace: [<ffffffff858579ba>] kmallocorder+0xda/0x110 [<ffffffff85857a11>] kmallocordertrace+0x21/0x130 [<ffffffff859c2ed1>] _kmalloc+0x711/0x8a0 [<ffffffff86160189>] jffs2suminit+0xd9/0x1a0 [<ffffffff86140e25>] jffs2domountfs+0x745/0x2120 [<ffffffff86149fec>] jffs2dofillsuper+0x35c/0x810 [<ffffffff8614aae9>] jffs2fill_super+0x2b9/0x3b0
This is because the resources allocated in jffs2suminit() are not released. Call jffs2sumexit() to release these resources to solve the problem.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3a4fff1e7e408c32649030daa7c2c42a7e19a95",
"id": "CVE-2022-49381-0416c565",
"signature_version": "v1",
"target": {
"file": "fs/jffs2/fs.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95496490937950093961353854052905517027",
"46677990474873576294546953939573487994",
"183752062438070060889297118167726935475",
"163189012238993356738649098313837965000"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ba7bbeab8009faf3a726e565d98816593ddd5b0",
"id": "CVE-2022-49381-0def71d1",
"signature_version": "v1",
"target": {
"file": "fs/jffs2/fs.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95496490937950093961353854052905517027",
"46677990474873576294546953939573487994",
"183752062438070060889297118167726935475",
"163189012238993356738649098313837965000"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69295267c481545f636b69ff341b8db75aa136b9",
"id": "CVE-2022-49381-2540e798",
"signature_version": "v1",
"target": {
"function": "jffs2_do_fill_super",
"file": "fs/jffs2/fs.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "98552623592210132679118443233414699557",
"length": 2274.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28048a4cf3813b7cf5cc8cce629dfdc7951cb1c2",
"id": "CVE-2022-49381-3217533e",
"signature_version": "v1",
"target": {
"function": "jffs2_do_fill_super",
"file": "fs/jffs2/fs.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "138180028551961068128479841028277536908",
"length": 2206.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecc53e58596542791e82eff00702f8af7a313f70",
"id": "CVE-2022-49381-3db95994",
"signature_version": "v1",
"target": {
"file": "fs/jffs2/fs.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95496490937950093961353854052905517027",
"46677990474873576294546953939573487994",
"183752062438070060889297118167726935475",
"163189012238993356738649098313837965000"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69295267c481545f636b69ff341b8db75aa136b9",
"id": "CVE-2022-49381-3efbd0a9",
"signature_version": "v1",
"target": {
"file": "fs/jffs2/fs.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95496490937950093961353854052905517027",
"46677990474873576294546953939573487994",
"183752062438070060889297118167726935475",
"163189012238993356738649098313837965000"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3a4fff1e7e408c32649030daa7c2c42a7e19a95",
"id": "CVE-2022-49381-59ca7f44",
"signature_version": "v1",
"target": {
"function": "jffs2_do_fill_super",
"file": "fs/jffs2/fs.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "98552623592210132679118443233414699557",
"length": 2274.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28048a4cf3813b7cf5cc8cce629dfdc7951cb1c2",
"id": "CVE-2022-49381-7462fbe3",
"signature_version": "v1",
"target": {
"file": "fs/jffs2/fs.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95496490937950093961353854052905517027",
"46677990474873576294546953939573487994",
"183752062438070060889297118167726935475",
"163189012238993356738649098313837965000"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3252d327f977b14663a10967f3b0930d6c325687",
"id": "CVE-2022-49381-7b188eb9",
"signature_version": "v1",
"target": {
"function": "jffs2_do_fill_super",
"file": "fs/jffs2/fs.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "98552623592210132679118443233414699557",
"length": 2274.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf9db013e167bc8fc2ecd7a13ed97a37df0c9dab",
"id": "CVE-2022-49381-9bbd53d9",
"signature_version": "v1",
"target": {
"file": "fs/jffs2/fs.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95496490937950093961353854052905517027",
"46677990474873576294546953939573487994",
"183752062438070060889297118167726935475",
"163189012238993356738649098313837965000"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4da8763a3d2b684c773b72ed80fad40bc264bc40",
"id": "CVE-2022-49381-a6b50fa1",
"signature_version": "v1",
"target": {
"file": "fs/jffs2/fs.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95496490937950093961353854052905517027",
"46677990474873576294546953939573487994",
"183752062438070060889297118167726935475",
"163189012238993356738649098313837965000"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c14adb1cf70a984ed081c67e9d27bc3caad9537c",
"id": "CVE-2022-49381-aed7b8c9",
"signature_version": "v1",
"target": {
"file": "fs/jffs2/fs.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95496490937950093961353854052905517027",
"46677990474873576294546953939573487994",
"183752062438070060889297118167726935475",
"163189012238993356738649098313837965000"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ba7bbeab8009faf3a726e565d98816593ddd5b0",
"id": "CVE-2022-49381-b3633d01",
"signature_version": "v1",
"target": {
"function": "jffs2_do_fill_super",
"file": "fs/jffs2/fs.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "97083789600058095546502805806880550875",
"length": 2220.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf9db013e167bc8fc2ecd7a13ed97a37df0c9dab",
"id": "CVE-2022-49381-cb748d24",
"signature_version": "v1",
"target": {
"function": "jffs2_do_fill_super",
"file": "fs/jffs2/fs.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "98552623592210132679118443233414699557",
"length": 2274.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4da8763a3d2b684c773b72ed80fad40bc264bc40",
"id": "CVE-2022-49381-db3ef092",
"signature_version": "v1",
"target": {
"function": "jffs2_do_fill_super",
"file": "fs/jffs2/fs.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "138180028551961068128479841028277536908",
"length": 2206.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecc53e58596542791e82eff00702f8af7a313f70",
"id": "CVE-2022-49381-ea617228",
"signature_version": "v1",
"target": {
"function": "jffs2_do_fill_super",
"file": "fs/jffs2/fs.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "98552623592210132679118443233414699557",
"length": 2274.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c14adb1cf70a984ed081c67e9d27bc3caad9537c",
"id": "CVE-2022-49381-f04c2ee1",
"signature_version": "v1",
"target": {
"function": "jffs2_do_fill_super",
"file": "fs/jffs2/fs.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "98552623592210132679118443233414699557",
"length": 2274.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3252d327f977b14663a10967f3b0930d6c325687",
"id": "CVE-2022-49381-f904fd6d",
"signature_version": "v1",
"target": {
"file": "fs/jffs2/fs.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95496490937950093961353854052905517027",
"46677990474873576294546953939573487994",
"183752062438070060889297118167726935475",
"163189012238993356738649098313837965000"
]
}
}
]