linux-cve-announce - CVE-2022-50478: nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100438-CVE-2022-50478-81f8@gregkh>
Date: Sat,  4 Oct 2025 17:16:37 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50478: nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()

Patch series "nilfs2: fix UBSAN shift-out-of-bounds warnings on mount
time".

The first patch fixes a bug reported by syzbot, and the second one fixes
the remaining bug of the same kind.  Although they are triggered by the
same super block data anomaly, I divided it into the above two because the
details of the issues and how to fix it are different.

Both are required to eliminate the shift-out-of-bounds issues at mount
time.

This patch (of 2):

If the block size exponent information written in an on-disk superblock is
corrupted, nilfs_sb2_bad_offset helper function can trigger
shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn
is set):

 shift exponent 38983 is too large for 64-bit type 'unsigned long long'
 Call Trace:
  <TASK>
  __dump_stack lib/dump_stack.c:88 [inline]
  dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
  ubsan_epilogue lib/ubsan.c:151 [inline]
  __ubsan_handle_shift_out_of_bounds+0x33d/0x3b0 lib/ubsan.c:322
  nilfs_sb2_bad_offset fs/nilfs2/the_nilfs.c:449 [inline]
  nilfs_load_super_block+0xdf5/0xe00 fs/nilfs2/the_nilfs.c:523
  init_nilfs+0xb7/0x7d0 fs/nilfs2/the_nilfs.c:577
  nilfs_fill_super+0xb1/0x5d0 fs/nilfs2/super.c:1047
  nilfs_mount+0x613/0x9b0 fs/nilfs2/super.c:1317
  ...

In addition, since nilfs_sb2_bad_offset() performs multiplication without
considering the upper bound, the computation may overflow if the disk
layout parameters are not normal.

This fixes these issues by inserting preliminary sanity checks for those
parameters and by converting the comparison from one involving
multiplication and left bit-shifting to one using division and right
bit-shifting.

The Linux kernel CVE team has assigned CVE-2022-50478 to this issue.

Affected and fixed versions
===========================

	Fixed in 4.9.337 with commit 6b0ea3df56cccd53398d0289f399f19d43136b2e
	Fixed in 4.14.303 with commit a6f89b10042baca218c8598d6db5a44c7e32625f
	Fixed in 4.19.270 with commit 9b3ba54025357440d6c4414c670984f628c6f6bf
	Fixed in 5.4.229 with commit d706485dffbbbf848e681edda29c7a46ac55698c
	Fixed in 5.10.163 with commit d464b035c0613856d012cf1704879d3ff3f057fb
	Fixed in 5.15.86 with commit b47f5c579c8186f7f5ab5e4254e0734ea5b7bf7a
	Fixed in 6.0.16 with commit 1012ff77284e3bec0ec0a35a820b03ec43dec2cc
	Fixed in 6.1.2 with commit 62d11ec205ef14d8acf172cfc9904fdbf200025a
	Fixed in 6.2 with commit 610a2a3d7d8be3537458a378ec69396a76c385b6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50478
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	fs/nilfs2/the_nilfs.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6b0ea3df56cccd53398d0289f399f19d43136b2e
	https://git.kernel.org/stable/c/a6f89b10042baca218c8598d6db5a44c7e32625f
	https://git.kernel.org/stable/c/9b3ba54025357440d6c4414c670984f628c6f6bf
	https://git.kernel.org/stable/c/d706485dffbbbf848e681edda29c7a46ac55698c
	https://git.kernel.org/stable/c/d464b035c0613856d012cf1704879d3ff3f057fb
	https://git.kernel.org/stable/c/b47f5c579c8186f7f5ab5e4254e0734ea5b7bf7a
	https://git.kernel.org/stable/c/1012ff77284e3bec0ec0a35a820b03ec43dec2cc
	https://git.kernel.org/stable/c/62d11ec205ef14d8acf172cfc9904fdbf200025a
	https://git.kernel.org/stable/c/610a2a3d7d8be3537458a378ec69396a76c385b6