linux-kernel - Forwarded: [PATCH] ocfs2: add validation for chain index in ocfs2_block_group

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <68ef2735.050a0220.1186a4.00a4.GAE@google.com>
Date: Tue, 14 Oct 2025 21:46:45 -0700
From: syzbot <syzbot+77026564530dbc29b854@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] ocfs2: add validation for chain index in ocfs2_block_group_fill

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] ocfs2: add validation for chain index in ocfs2_block_group_fill
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

Add validation to ensure my_chain index is within bounds before
accessing cl->cl_recs[] array. Without this check, a corrupted
filesystem with cl_count set to 0 can trigger an out-of-bounds
array access, detected by UBSAN.

The issue was exposed by commit aa545adbe491 ("ocfs2: annotate
flexible array members with __counted_by_le()"), which added
the __counted_by_le() annotation to cl_recs[], allowing UBSAN
to detect the out-of-bounds access.

UBSAN report:
  UBSAN: array-index-out-of-bounds in fs/ocfs2/suballoc.c:380:22
  index 0 is out of range for type 'struct ocfs2_chain_rec[]'

The fix adds an explicit bounds check at the start of
ocfs2_block_group_fill() to validate my_chain is less than
cl->cl_count before accessing the array, preventing the
out-of-bounds access and properly handling corrupted
filesystems.

Reported-by: syzbot+77026564530dbc29b854@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=77026564530dbc29b854
Fixes: aa545adbe491 ("ocfs2: annotate flexible array members with __counted_by_le()")
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
 fs/ocfs2/suballoc.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index 6ac4dcd54588..dd58cc0f9838 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -353,6 +353,14 @@ static int ocfs2_block_group_fill(handle_t *handle,
 	struct ocfs2_super *osb = OCFS2_SB(alloc_inode->i_sb);
 	struct ocfs2_group_desc *bg = (struct ocfs2_group_desc *) bg_bh->b_data;
 	struct super_block * sb = alloc_inode->i_sb;
+
+	/* Validate chain index before accessing cl_recs array */
+	if (my_chain >= le16_to_cpu(cl->cl_count)) {
+		status = ocfs2_error(alloc_inode->i_sb,
+				     "chain index %u out of range (count=%u)\n",
+				     my_chain, le16_to_cpu(cl->cl_count));
+		goto bail;
+	}

 	if (((unsigned long long) bg_bh->b_blocknr) != group_blkno) {
 		status = ocfs2_error(alloc_inode->i_sb,
-- 
2.43.0