linux-kernel - [bug report] fs: f2fs: integer overflow in f2fs_truncate_inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 22 Mar 2024 09:05:32 +0000
From: Roman Smirnov <r.smirnov@....ru>
To: "jaegeuk@...nel.org" <jaegeuk@...nel.org>, "chao@...nel.org"
	<chao@...nel.org>
CC: "linux-f2fs-devel@...ts.sourceforge.net"
	<linux-f2fs-devel@...ts.sourceforge.net>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, Sergey Shtylyov <s.shtylyov@....ru>, "Karina
 Yankevich" <k.yankevich@....ru>, "lvc-project@...uxtesting.org"
	<lvc-project@...uxtesting.org>
Subject: [bug report] fs: f2fs: integer overflow in
 f2fs_truncate_inode_blocks()

Hello. 

There is a possible bug in f2fs_truncate_inode_blocks():

    if (err < 0 && err != -ENOENT)
    			goto fail;
        ...
        offset[1] = 0;
        offset[0]++;
        nofs += err;

If err = -ENOENT then nofs will sum with an error code,
which is strange behaviour. Also if nofs < ENOENT this will
cause an overflow. err will be equal to -ENOENT with the
following call stack:

truncate_nodes()
  f2fs_get_node_page()
     __get_node_page()
        read_node_page()

It looks like ENOENT processing is missing here. What can you
say about it? How can it be fixed?

Found by Linux Verification Center (linuxtesting.org) with the
Svace static analysis tool.