linux-kernel - [PATCH] jfs: upper bound check of tree index in dbAllocAG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250424-ubsan-jfs-v1-1-2eab57c1ac50@arnaud-lcm.com>
Date: Thu, 24 Apr 2025 00:13:51 +0200
From: Arnaud Lecomte <contact@...aud-lcm.com>
To: Dave Kleikamp <shaggy@...nel.org>
Cc: jfs-discussion@...ts.sourceforge.net, linux-kernel@...r.kernel.org,
 skhan@...uxfoundation.org,
 syzbot+cffd18309153948f3c3e@...kaller.appspotmail.com,
 Arnaud Lecomte <contact@...aud-lcm.com>
Subject: [PATCH] jfs: upper bound check of tree index in dbAllocAG

When computing the tree index in dbAllocAG, we never check we are not
out of bounds from the size of the stree.
This could happen in a scenario where the filesystem metadata are
corrupted.

Reported-by: syzbot+cffd18309153948f3c3e@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cffd18309153948f3c3e
Tested-by: syzbot+cffd18309153948f3c3e@...kaller.appspotmail.com
Fixes: 263e55949d89 ("x86/cpu/amd: Fix workaround for erratum 1054")
Signed-off-by: Arnaud Lecomte <contact@...aud-lcm.com>
---
 fs/jfs/jfs_dmap.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 26e89d0c69b6..7acebb9a21b0 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1385,6 +1385,12 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results)
 	    (1 << (L2LPERCTL - (bmp->db_agheight << 1))) / bmp->db_agwidth;
 	ti = bmp->db_agstart + bmp->db_agwidth * (agno & (agperlev - 1));
 
+	if (ti < 0 || ti >= le32_to_cpu(dcp->nleafs)) {
+		jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page: ti out of bounds\n");
+		release_metapage(mp);
+		return -EIO;
+	}
+
 	/* dmap control page trees fan-out by 4 and a single allocation
 	 * group may be described by 1 or 2 subtrees within the ag level
 	 * dmap control page, depending upon the ag size. examine the ag's

---
base-commit: 8560697b23dc2f405cb463af2b17256a9888129d
change-id: 20250423-ubsan-jfs-3a58acae5e57

Best regards,
-- 
Arnaud Lecomte <contact@...aud-lcm.com>