linux-kernel - [PATCH] bcachefs: Fix shift-out-of-bounds in bch2_stripe_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20240927053849.3740994-1-zhaomzhao@126.com>
Date: Fri, 27 Sep 2024 13:38:49 +0800
From: Zhao Mengmeng <zhaomzhao@....com>
To: kent.overstreet@...ux.dev,
	zhaomengmeng@...inos.cn
Cc: linux-bcachefs@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] bcachefs: Fix shift-out-of-bounds in bch2_stripe_to_text

From: Zhao Mengmeng <zhaomengmeng@...inos.cn>

syzbot report a shift-out-of-bounds issue:
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/bcachefs/ec.c:147:2
shift exponent 108 is too large for 32-bit type 'unsigned int'
----
Here s.csum_granularity_bits = 108, shift is impossible for unsigned
int, so modify the prt_printf() output to dump csum_granularity_bits
rather than the actual value.

Reported-by: syzbot+f8c98a50c323635be65d@...kaller.appspotmail.com
Tested-by: syzbot+f8c98a50c323635be65d@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f8c98a50c323635be65d
Signed-off-by: Zhao Mengmeng <zhaomengmeng@...inos.cn>
---
 fs/bcachefs/ec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/bcachefs/ec.c b/fs/bcachefs/ec.c
index 141a4c63142f..2d5cd9d837f2 100644
--- a/fs/bcachefs/ec.c
+++ b/fs/bcachefs/ec.c
@@ -144,7 +144,7 @@ void bch2_stripe_to_text(struct printbuf *out, struct bch_fs *c,
 		   nr_data,
 		   s.nr_redundant);
 	bch2_prt_csum_type(out, s.csum_type);
-	prt_printf(out, " gran %u", 1U << s.csum_granularity_bits);
+	prt_printf(out, " gran 1<<%u", s.csum_granularity_bits);
 
 	for (unsigned i = 0; i < s.nr_blocks; i++) {
 		const struct bch_extent_ptr *ptr = sp->ptrs + i;
-- 
2.43.0