linux-kernel - Re: [PATCH] jfs: fix array-index-out-of-bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAG-BmocfstJNC-JDgtx93EJmg5kMANu4tVRbjqYtZ1CE+AEnEg@mail.gmail.com>
Date: Mon, 23 Sep 2024 09:05:13 +0530
From: Ghanshyam Agrawal <ghanshyam1898@...il.com>
To: Christophe JAILLET <christophe.jaillet@...adoo.fr>
Cc: shaggy@...nel.org, ghandatmanas@...il.com, jlayton@...nel.org, 
	eadavis@...com, brauner@...nel.org, jfs-discussion@...ts.sourceforge.net, 
	linux-kernel@...r.kernel.org, 
	syzbot+808f3f84407f08a93022@...kaller.appspotmail.com
Subject: Re: [PATCH] jfs: fix array-index-out-of-bounds

On Sun, Sep 22, 2024 at 8:35 PM Christophe JAILLET
<christophe.jaillet@...adoo.fr> wrote:
>
> Le 22/09/2024 à 13:00, Ghanshyam Agrawal a écrit :
> > In some cases, dn_numag may be greater than MAXAG which may
> > result in an array-index-out-of-bounds in dbNextAG. Added
> > a check to return an error code before we crash.
> >
> > Reported-by: syzbot+808f3f84407f08a93022@...kaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=808f3f84407f08a93022
> > Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@...il.com>
> > ---
> >   fs/jfs/jfs_imap.c | 3 +++
> >   1 file changed, 3 insertions(+)
> >
> > diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
> > index 2ec35889ad24..5088da13e8f1 100644
> > --- a/fs/jfs/jfs_imap.c
> > +++ b/fs/jfs/jfs_imap.c
> > @@ -1360,6 +1360,9 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
> >       if (agno < 0 || agno > dn_numag)
> >               return -EIO;
> >
> > +     if (unlikely(dn_numag > MAXAG))
>
> Hi,
>
> looking at other places with checks with MAXAG, I wonder if it should be >=?
>
> CJ
>
> > +             return -EIO;
> > +
> >       if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
> >               /*
> >                * There is an open file actively growing.  We want to
>

Hello Christophe,

Thanks for reviewing my code. I believe the greater than symbol I have
set is correct in this case. Can you please check it thoroughly and let
me know wny it should be >= ?

Thanks & Regards,
Ghanshyam Agrawal