[PATCH] f2fs: check log_blocksize bounds in __f2fs_commit_super

[PATCH] f2fs: check log_blocksize bounds in __f2fs_commit_super

[Svyatoslav Nikolenko]

Syzbot reported a shift-out-of-bounds panic in SECTOR_FROM_BLOCK() during
superblock writeback via __f2fs_commit_super().

When mounting a corrupted filesystem image where log_blocksize is set to 0,
f2fs attempts to perform recovery or commit the superblock status.
SECTOR_FROM_BLOCK() relies on F2FS_LOG_SECTORS_PER_BLOCK(sbi), which evaluates
to (sbi->log_blocksize - 9). When log_blocksize is 0, this calculates 0 - 9 = -9,
causing an unsigned underflow (4294967287) and triggering a UBSAN shift
out-of-bounds error when shifting sector addresses.

Fix this by validating sbi->log_blocksize at the top of __f2fs_commit_super()
and returning -EFSCORRUPTED if it is less than 9 (the minimum valid sector shift exponent).

Reported-by: syzbot+dfcbc1741488709db4b2@syzkaller.appspotmail.com
Tested-by: syzbot+dfcbc1741488709db4b2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dfcbc1741488709db4b2
Signed-off-by: Svyatoslav Nikolenko <nsvatoslav515@gmail.com>
---
 fs/f2fs/super.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 6a2f09c61dcd..b6b32bcbc126 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -3934,6 +3934,9 @@ static int __f2fs_commit_super(struct f2fs_sb_info *sbi, struct folio *folio,
 	blk_opf_t opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH | REQ_FUA;
 	int ret;
 
+	if (unlikely(sbi->log_blocksize < 9))
+		return -EFSCORRUPTED;
+
 	folio_lock(folio);
 	folio_wait_writeback(folio);
 	if (update)
-- 
2.47.3