linux-kernel - Re: [PATCH] jfs: validate budmin to prevent shift-out-of-bounds in dbAllocAG()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9bb82a26-c0e7-4e3f-abce-0ef07e1cff66@gmail.com>
Date: Wed, 22 Oct 2025 09:22:28 -0400
From: David Hunter <david.hunter.linux@...il.com>
To: sukrut heroorkar <hsukrut3@...il.com>
Cc: Dave Kleikamp <shaggy@...nel.org>, Rand Deeb <rand.sec96@...il.com>,
 Edward Adam Davis <eadavis@...com>,
 Ghanshyam Agrawal <ghanshyam1898@...il.com>,
 Nihar Chaithanya <niharchaithanya@...il.com>,
 Vasiliy Kovalev <kovalev@...linux.org>,
 Arnaud Lecomte <contact@...aud-lcm.com>,
 "open list:JFS FILESYSTEM" <jfs-discussion@...ts.sourceforge.net>,
 open list <linux-kernel@...r.kernel.org>, skhan@...ux.foundation.org,
 syzbot+4b717071f1eecb2972df@...kaller.appspotmail.com
Subject: Re: [PATCH] jfs: validate budmin to prevent shift-out-of-bounds in
 dbAllocAG()

On 10/19/25 05:42, sukrut heroorkar wrote:
> Hi David,
> On Sun, Oct 19, 2025 at 12:50 AM David Hunter
> <david.hunter.linux@...il.com> wrote:
>>
>> On 10/18/25 01:30, Sukrut Heroorkar wrote:
>>> Tested-by: syzbot+4b717071f1eecb2972df@...kaller.appspotmail.com
>>
>>
>> Hey Sukrut,
>>
>> Did you do any other testing other than syzbot testing?
> I also used the C reproducer to test my fix locally with QEMU and it
> no longer triggers error. Do you recommend any
> other tests? Please let me know.
> Thanks,
> Sukrut.
>> Thanks,
>> David Hunter


Hey Sukrut,

You always need to do testing to ensure that your code does not bring in
regressions into the kernel. If doing things to file systems, xfstests
is at least the basic testing that you should do. You can also search to
see if any other publicly tools are available and/or applicable, but
xfstests are the minimum.

Thanks,
David Hunter