linux-kernel - Re: [syzbot] [ext4?] divide error in ext4_mb_regular

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_0F27C706CC52D386584988EECBEEC0CCA206@qq.com>
Date: Wed, 14 Aug 2024 08:35:26 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+1ad8bac5af24d01e2cbd@...kaller.appspotmail.com
Cc: adilger.kernel@...ger.ca,
	jack@...e.cz,
	linux-ext4@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	ojaswin@...ux.ibm.com,
	syzkaller-bugs@...glegroups.com,
	tytso@....edu
Subject: Re: [syzbot] [ext4?] divide error in ext4_mb_regular_allocator

Before determining that the goal length is a multiple of the stripe size, 
check CR_GOAL_LEN_FAST and CR_BEST_AVAIL_LEN first.

Fixes: 1f6bc02f1848 ("ext4: fallback to complex scan if aligned scan doesn't work")
Reported-by: syzbot+1ad8bac5af24d01e2cbd@...kaller.appspotmail.com

#syz test: upstream ee9a43b7cfe2

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 9dda9cd68ab2..451f92cde461 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2928,13 +2928,12 @@ ext4_mb_regular_allocator(struct ext4_allocation_context *ac)
 			if (cr == CR_POWER2_ALIGNED)
 				ext4_mb_simple_scan_group(ac, &e4b);
 			else {
-				bool is_stripe_aligned = sbi->s_stripe &&
+				bool is_stripe_aligned = (cr == CR_GOAL_LEN_FAST ||
+					cr == CR_BEST_AVAIL_LEN) && sbi->s_stripe &&
 					!(ac->ac_g_ex.fe_len %
 					  EXT4_B2C(sbi, sbi->s_stripe));
 
-				if ((cr == CR_GOAL_LEN_FAST ||
-				     cr == CR_BEST_AVAIL_LEN) &&
-				    is_stripe_aligned)
+				if (is_stripe_aligned)
 					ext4_mb_scan_aligned(ac, &e4b);
 
 				if (ac->ac_status == AC_STATUS_CONTINUE)