[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <7ce1a9af-e966-2d1e-2e80-bb019a35a22b@gmail.com>
Date: Mon, 2 Oct 2023 10:05:50 +0530
From: Manas Ghandat <ghandatmanas@...il.com>
To: dave.kleikamp@...cle.com, shaggy@...nel.org
Cc: jfs-discussion@...ts.sourceforge.net, linux-kernel@...r.kernel.org,
Linux-kernel-mentees@...ts.linuxfoundation.org,
syzbot+aea1ad91e854d0a83e04@...kaller.appspotmail.com
Subject: Re: [PATCH v2] jfs: fix array-index-out-of-bounds in dbFindLeaf
just a friendly ping
On 22/09/23 17:33, Manas Ghandat wrote:
> Currently while searching for dmtree_t for sufficient free blocks there
> is an array out of bounds while getting element in tp->dm_stree. To add
> the required check for out of bound we first need to determine the type
> of dmtree. Thus added an extra parameter to dbFindLeaf so that the type
> of tree can be determined and the required check can be applied.
>
> Reported-by: syzbot+aea1ad91e854d0a83e04@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=aea1ad91e854d0a83e04
> Signed-off-by: Manas Ghandat <ghandatmanas@...il.com>
> ---
> V1 -> V2: Updated dbFindLeaf function.
>
> fs/jfs/jfs_dmap.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index a14a0f18a4c4..cee5164c4879 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -87,7 +87,7 @@ static int dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno,
> static int dbExtend(struct inode *ip, s64 blkno, s64 nblocks, s64 addnblocks);
> static int dbFindBits(u32 word, int l2nb);
> static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno);
> -static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx);
> +static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, int type);
> static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
> int nblocks);
> static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno,
> @@ -1709,7 +1709,7 @@ static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno)
> * dbFindLeaf() returns the index of the leaf at which
> * free space was found.
> */
> - rc = dbFindLeaf((dmtree_t *) dcp, l2nb, &leafidx);
> + rc = dbFindLeaf((dmtree_t *) dcp, l2nb, &leafidx, 0);
>
> /* release the buffer.
> */
> @@ -1956,7 +1956,7 @@ dbAllocDmapLev(struct bmap * bmp,
> * free space. if sufficient free space is found, dbFindLeaf()
> * returns the index of the leaf at which free space was found.
> */
> - if (dbFindLeaf((dmtree_t *) & dp->tree, l2nb, &leafidx))
> + if (dbFindLeaf((dmtree_t *) &dp->tree, l2nb, &leafidx, 1))
> return -ENOSPC;
>
> if (leafidx < 0)
> @@ -2920,14 +2920,18 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval)
> * leafidx - return pointer to be set to the index of the leaf
> * describing at least l2nb free blocks if sufficient
> * free blocks are found.
> + * type - type of dmtree
> *
> * RETURN VALUES:
> * 0 - success
> * -ENOSPC - insufficient free blocks.
> */
> -static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx)
> +static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, int type)
> {
> int ti, n = 0, k, x = 0;
> + int max_size;
> +
> + max_size = type ? TREESIZE : CTLTREESIZE;
>
> /* first check the root of the tree to see if there is
> * sufficient free space.
> @@ -2948,6 +2952,8 @@ static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx)
> /* sufficient free space found. move to the next
> * level (or quit if this is the last level).
> */
> + if (x + n > max_size)
> + return -ENOSPC;
> if (l2nb <= tp->dmt_stree[x + n])
> break;
> }
Powered by blists - more mailing lists