linux-kernel - Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diNewExt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <000000000000775780060c3b19d2@google.com>
Date:   Mon, 11 Dec 2023 04:30:30 -0800
From:   syzbot <syzbot+553d90297e6d2f50dbc7@...kaller.appspotmail.com>
To:     linux-kernel@...r.kernel.org
Subject: Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diNewExt

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: [jfs?] UBSAN: array-index-out-of-bounds in diNewExt
Author: eadavis@...com

please test array-index-out-of-bounds in diNewExt

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git bee0e7762ad2

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index a037ee59e398..8fc28b655060 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -1341,6 +1341,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
 	 */
 	if (dir) {
 		agno = dbNextAG(JFS_SBI(pip->i_sb)->ipbmap);
+		printk("agno/dbNextAG: %d, %s\n", agno, __func__);
 		AG_LOCK(imap, agno);
 		goto tryag;
 	}
@@ -1356,6 +1357,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
 
 	/* get the ag number of this iag */
 	agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
+	printk("agno/agstart: %d, %s\n", agno, __func__);
 	dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
 	if (agno < 0 || agno > dn_numag)
 		return -EIO;
@@ -1584,6 +1586,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
 	/*
 	 * try to allocate anywhere within the same AG as the parent inode.
 	 */
+	printk("agno: %d, %s\n", agno, __func__);
 	rc = diAllocAG(imap, agno, dir, ip);
 
 	AG_UNLOCK(imap, agno);
@@ -2179,6 +2182,9 @@ static int diNewExt(struct inomap * imap, struct iag * iagp, int extno)
 	/* get the ag and iag numbers for this iag.
 	 */
 	agno = BLKTOAG(le64_to_cpu(iagp->agstart), sbi);
+	if (agno > MAXAG || agno < 0)
+		return -EINVAL;
+
 	iagno = le32_to_cpu(iagp->iagnum);
 
 	/* check if this is the last free extent within the