CVE-2022-49062

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Fix KASAN slab-out-of-bounds in cachefilessetvolume_xattr

Use the actual length of volume coherency data when setting the xattr to avoid the following KASAN report.

BUG: KASAN: slab-out-of-bounds in cachefilessetvolume_xattr+0xa0/0x350 [cachefiles] Write of size 4 at addr ffff888101e02af4 by task kworker/6:0/1347

CPU: 6 PID: 1347 Comm: kworker/6:0 Kdump: loaded Not tainted 5.18.0-rc1-nfs-fscache-netfs+ #13 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014 Workqueue: events fscachecreatevolumework [fscache] Call Trace: <TASK> dumpstacklvl+0x45/0x5a printreport.cold+0x5e/0x5db ? _locktextstart+0x8/0x8 ? cachefilessetvolumexattr+0xa0/0x350 [cachefiles] kasanreport+0xab/0x120 ? cachefilessetvolumexattr+0xa0/0x350 [cachefiles] kasancheckrange+0xf5/0x1d0 memcpy+0x39/0x60 cachefilessetvolumexattr+0xa0/0x350 [cachefiles] cachefilesacquirevolume+0x2be/0x500 [cachefiles] ? _cachefilesfreevolume+0x90/0x90 [cachefiles] fscachecreatevolumework+0x68/0x160 [fscache] processonework+0x3b7/0x6a0 workerthread+0x2c4/0x650 ? processonework+0x6a0/0x6a0 kthread+0x16c/0x1a0 ? kthreadcompleteandexit+0x20/0x20 retfrom_fork+0x22/0x30 </TASK>

Allocated by task 1347: kasansavestack+0x1e/0x40 _kasankmalloc+0x81/0xa0 cachefilessetvolumexattr+0x76/0x350 [cachefiles] cachefilesacquirevolume+0x2be/0x500 [cachefiles] fscachecreatevolumework+0x68/0x160 [fscache] processonework+0x3b7/0x6a0 workerthread+0x2c4/0x650 kthread+0x16c/0x1a0 retfrom_fork+0x22/0x30

The buggy address belongs to the object at ffff888101e02af0 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 4 bytes inside of 8-byte region [ffff888101e02af0, ffff888101e02af8)

The buggy address belongs to the physical page: page:00000000a2292d70 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x101e02 flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0000200 0000000000000000 dead000000000001 ffff888100042280 raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff888101e02980: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc ffff888101e02a00: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00

ffff888101e02a80: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 04 fc ^ ffff888101e02b00: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc ffff888101e02b80: fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc ==================================================================