From fd481965777d8a4fa677ec8318d2562737b2d745 Mon Sep 17 00:00:00 2001 From: Zhao Mengmeng Date: Wed, 9 Oct 2024 11:18:04 +0800 Subject: [PATCH] bcachefs: Fix shift-out-of-bounds in bch2_stripe_to_text syzbot report a shift-out-of-bounds issue: ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in fs/bcachefs/ec.c:147:2 shift exponent 108 is too large for 32-bit type 'unsigned int' ---- Here s.csum_granularity_bits = 108, so shift is impossible for unsigned int. To fix, add a check in bch2_stripe_validate() to bail out, it has same checking logic with ec_stripe_key_init(). Reported-by: syzbot+f8c98a50c323635be65d@syzkaller.appspotmail.com Tested-by: syzbot+f8c98a50c323635be65d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f8c98a50c323635be65d Suggested-by: Hongbo Li Signed-off-by: Zhao Mengmeng --- fs/bcachefs/ec.c | 6 ++++++ fs/bcachefs/errcode.h | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/bcachefs/ec.c b/fs/bcachefs/ec.c index 141a4c63142f..bc5ff1331c6f 100644 --- a/fs/bcachefs/ec.c +++ b/fs/bcachefs/ec.c @@ -113,6 +113,12 @@ int bch2_stripe_validate(struct bch_fs *c, struct bkey_s_c k, const struct bch_stripe *s = bkey_s_c_to_stripe(k).v; int ret = 0; + if (s->csum_granularity_bits >= ilog2(le16_to_cpu(s->sectors))) { + bch_err_ratelimited(c, "stripe csum gran bits %u too big", + s->csum_granularity_bits); + return -BCH_ERR_stripe_csum_granularity_bits_too_big; + } + bkey_fsck_err_on(bkey_eq(k.k->p, POS_MIN) || bpos_gt(k.k->p, POS(0, U32_MAX)), c, stripe_pos_bad, diff --git a/fs/bcachefs/errcode.h b/fs/bcachefs/errcode.h index 742dcdd3e5d7..14ba6bc7a029 100644 --- a/fs/bcachefs/errcode.h +++ b/fs/bcachefs/errcode.h @@ -258,7 +258,8 @@ x(BCH_ERR_nopromote, nopromote_no_writes) \ x(BCH_ERR_nopromote, nopromote_enomem) \ x(0, invalid_snapshot_node) \ - x(0, option_needs_open_fs) + x(0, option_needs_open_fs) \ + x(EINVAL, stripe_csum_granularity_bits_too_big) enum bch_errcode { BCH_ERR_START = 2048, -- 2.43.0