linux-kernel - Re: [Jfs-discussion] [PATCH] jfs: upper bound check of tree index in dbAllocAG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <32e5a374-3b00-4450-a1f7-2729f1e3dfec@oracle.com>
Date: Mon, 28 Jul 2025 12:58:13 -0500
From: Dave Kleikamp <dave.kleikamp@...cle.com>
To: Arnaud Lecomte <contact@...aud-lcm.com>
Cc: jfs-discussion@...ts.sourceforge.net,
        syzbot+cffd18309153948f3c3e@...kaller.appspotmail.com,
        linux-kernel@...r.kernel.org, skhan@...uxfoundation.org
Subject: Re: [Jfs-discussion] [PATCH] jfs: upper bound check of tree index in
 dbAllocAG

On 7/27/25 4:55AM, Arnaud Lecomte wrote:
> Hi Dave,
> I am bumping the thread as I was wondering if you have some updates.
> Thanks !

It's in linux-next. I'll be pushing it to Linus this week.

Thanks,
Shaggy
> 
> On 14/07/2025 21:35, Lecomte, Arnaud wrote:
>> Thanks Dave !
>>
>> On 11/07/2025 20:23, Dave Kleikamp wrote:
>>> I'm finally trying to catch up.
>>>
>>> On 4/23/25 5:13PM, Arnaud Lecomte via Jfs-discussion wrote:
>>>> When computing the tree index in dbAllocAG, we never check we are not
>>>> out of bounds from the size of the stree.
>>>> This could happen in a scenario where the filesystem metadata are
>>>> corrupted.
>>>
>>> Looks good. I'll apply and test this.
>>>
>>>>
>>>> Reported-by: syzbot+cffd18309153948f3c3e@...kaller.appspotmail.com
>>>> Closes: https://syzkaller.appspot.com/bug?extid=cffd18309153948f3c3e
>>>> Tested-by: syzbot+cffd18309153948f3c3e@...kaller.appspotmail.com
>>>> Fixes: 263e55949d89 ("x86/cpu/amd: Fix workaround for erratum 1054")
>>>
>>> Removing the Fixes: line. This doesn't make sense.
>>>
>>>> Signed-off-by: Arnaud Lecomte <contact@...aud-lcm.com>
>>>> ---
>>>>   fs/jfs/jfs_dmap.c | 6 ++++++
>>>>   1 file changed, 6 insertions(+)
>>>>
>>>> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
>>>> index 26e89d0c69b6..7acebb9a21b0 100644
>>>> --- a/fs/jfs/jfs_dmap.c
>>>> +++ b/fs/jfs/jfs_dmap.c
>>>> @@ -1385,6 +1385,12 @@ dbAllocAG(struct bmap * bmp, int agno, s64 
>>>> nblocks, int l2nb, s64 * results)
>>>>           (1 << (L2LPERCTL - (bmp->db_agheight << 1))) / bmp- 
>>>> >db_agwidth;
>>>>       ti = bmp->db_agstart + bmp->db_agwidth * (agno & (agperlev - 1));
>>>>   +    if (ti < 0 || ti >= le32_to_cpu(dcp->nleafs)) {
>>>> +        jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page: ti 
>>>> out of bounds\n");
>>>> +        release_metapage(mp);
>>>> +        return -EIO;
>>>> +    }
>>>> +
>>>>       /* dmap control page trees fan-out by 4 and a single allocation
>>>>        * group may be described by 1 or 2 subtrees within the ag level
>>>>        * dmap control page, depending upon the ag size. examine the 
>>>> ag's
>>>>
>>>> ---
>>>> base-commit: 8560697b23dc2f405cb463af2b17256a9888129d
>>>> change-id: 20250423-ubsan-jfs-3a58acae5e57
>>>>
>>>> Best regards,
>>>
>>>