From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from canpmsgout06.his.huawei.com (canpmsgout06.his.huawei.com [113.46.200.221]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 07F2D15B135 for ; Sat, 29 Nov 2025 01:15:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.221 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764378948; cv=none; b=daoSPvUxpqwhTpQg65UuXIx59/YjnQ3iEWQJRrlAPhfIP29OlCcJcVZ1iU+/Vwd/Ie0mFQaZzr1JrGokRfU1npoPIA9EEQ3py9SHFosbg5vKc/JDt1Pn7UgJbZXKaFOKcmYoiF+Z35GGownSPb7IZnRHq76fUyz39N3whVUi2hU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764378948; c=relaxed/simple; bh=KqADszpZYoX7qXg1uf+xTBr4soWWvczDYolyHESBTko=; h=Message-ID:Date:MIME-Version:Subject:To:CC:References:From: In-Reply-To:Content-Type; b=EJ1zJeWo7lOKl5w9xa//wOupctTlQaIx6TatZGcNUQamB/oAqT+NrBd1eFiFZCMmZU9py6Leiqfsmbus2FOFNcsH4CZHXAqpBRFIzMD7ngsshEnAzt06+OdAL2ks12/42hsvcgNSid9MpjzTbLcuJl+s2PodbtHeRFaILuxekbQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=L7KKdoJg; arc=none smtp.client-ip=113.46.200.221 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="L7KKdoJg" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=LXsknlZt4ReqSl7GuQSyOxUqfbkcLZE1qF9Smjkpguo=; b=L7KKdoJgXdTDDUKF32rCIw84UhEIlCupDQjRjV0LWAx+ifYw9p9fMHm9a0Y5G/kG7V0Jk9YPa DtjMmxE0vJkmeRJU7BWRChFXyGfy/oP3h02iotoqZgRt99fHhq8VqH5eo9H6NbocnxQGKbGtSjR JJTP6wJVR7FmynnrbgR7Yos= Received: from mail.maildlp.com (unknown [172.19.162.254]) by canpmsgout06.his.huawei.com (SkyGuard) with ESMTPS id 4dJBy85zTMzRhQT; Sat, 29 Nov 2025 09:13:52 +0800 (CST) Received: from kwepemj200013.china.huawei.com (unknown [7.202.194.25]) by mail.maildlp.com (Postfix) with ESMTPS id 74C55180464; Sat, 29 Nov 2025 09:15:42 +0800 (CST) Received: from [10.174.179.155] (10.174.179.155) by kwepemj200013.china.huawei.com (7.202.194.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Sat, 29 Nov 2025 09:15:41 +0800 Message-ID: <2febd16b-77a3-45c7-80cb-e324d3540746@huawei.com> Date: Sat, 29 Nov 2025 09:15:40 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: =?UTF-8?B?TW96aWxsYSBUaHVuZGVyYmlyZCDmtYvor5XniYg=?= Subject: Re: [PATCH v2] jfs: add dmapctl integrity check to prevent invalid operations To: Yun Zhou , CC: , , , , , , yangerkun , References: <20251128155150.1493986-1-yun.zhou@windriver.com> From: Li Lingfeng In-Reply-To: <20251128155150.1493986-1-yun.zhou@windriver.com> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit X-ClientProxiedBy: kwepems500002.china.huawei.com (7.221.188.17) To kwepemj200013.china.huawei.com (7.202.194.25) Hi Yun, 在 2025/11/28 23:51, Yun Zhou 写道: > Add check_dmapctl() to validate dmapctl structure integrity, focusing on > preventing invalid operations caused by on-disk corruption. > > Key checks: > - nleafs bounded by [0, LPERCTL] (maximum leaf nodes per dmapctl). > - l2nleafs bounded by [0, L2LPERCTL] and consistent with nleafs > (nleafs must be 2^l2nleafs). > - leafidx must be exactly CTLLEAFIND (expected leaf index position). > - height bounded by [0, L2LPERCTL >> 1] (valid tree height range). > - budmin validity: NOFREE only if nleafs=0; otherwise >= BUDMIN. > - Leaf nodes fit within stree array (leafidx + nleafs <= CTLTREESIZE). > - Leaf node values are either non-negative or NOFREE. > > Invoked in dbAllocAG(), dbFindCtl(), dbAdjCtl() and dbExtendFS() when > accessing dmapctl pages, catching corruption early before dmap operations > trigger invalid memory access or logic errors. > > This fixes the following UBSAN warning. > > [58245.668090][T14017] ------------[ cut here ]------------ > [58245.668103][T14017] UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:2641:11 > [58245.668119][T14017] shift exponent 110 is too large for 32-bit type 'int' > [58245.668137][T14017] CPU: 0 UID: 0 PID: 14017 Comm: 4c1966e88c28fa9 Tainted: G E 6.18.0-rc4-00253-g21ce5d4ba045-dirty #124 PREEMPT_{RT,(full)} > [58245.668174][T14017] Tainted: [E]=UNSIGNED_MODULE > [58245.668176][T14017] Hardware name: QEMU Ubuntu 25.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 > [58245.668184][T14017] Call Trace: > [58245.668200][T14017] > [58245.668208][T14017] dump_stack_lvl+0x189/0x250 > [58245.668288][T14017] ? __pfx_dump_stack_lvl+0x10/0x10 > [58245.668301][T14017] ? __pfx__printk+0x10/0x10 > [58245.668315][T14017] ? lock_metapage+0x303/0x400 [jfs] > [58245.668406][T14017] ubsan_epilogue+0xa/0x40 > [58245.668422][T14017] __ubsan_handle_shift_out_of_bounds+0x386/0x410 > [58245.668462][T14017] dbSplit+0x1f8/0x200 [jfs] > [58245.668543][T14017] dbAdjCtl+0x34c/0xa20 [jfs] > [58245.668628][T14017] dbAllocNear+0x2ee/0x3d0 [jfs] > [58245.668710][T14017] dbAlloc+0x933/0xba0 [jfs] > [58245.668797][T14017] ea_write+0x374/0xdd0 [jfs] > [58245.668888][T14017] ? __pfx_ea_write+0x10/0x10 [jfs] > [58245.668966][T14017] ? __jfs_setxattr+0x76e/0x1120 [jfs] > [58245.669046][T14017] __jfs_setxattr+0xa01/0x1120 [jfs] > [58245.669135][T14017] ? __pfx___jfs_setxattr+0x10/0x10 [jfs] > [58245.669216][T14017] ? mutex_lock_nested+0x154/0x1d0 > [58245.669252][T14017] ? __jfs_xattr_set+0xb9/0x170 [jfs] > [58245.669333][T14017] __jfs_xattr_set+0xda/0x170 [jfs] > [58245.669430][T14017] ? __pfx___jfs_xattr_set+0x10/0x10 [jfs] > [58245.669509][T14017] ? xattr_full_name+0x6f/0x90 > [58245.669546][T14017] ? jfs_xattr_set+0x33/0x60 [jfs] > [58245.669636][T14017] ? __pfx_jfs_xattr_set+0x10/0x10 [jfs] > [58245.669726][T14017] __vfs_setxattr+0x43c/0x480 > [58245.669743][T14017] __vfs_setxattr_noperm+0x12d/0x660 > [58245.669756][T14017] vfs_setxattr+0x16b/0x2f0 > [58245.669768][T14017] ? __pfx_vfs_setxattr+0x10/0x10 > [58245.669782][T14017] filename_setxattr+0x274/0x600 > [58245.669795][T14017] ? __pfx_filename_setxattr+0x10/0x10 > [58245.669806][T14017] ? getname_flags+0x1e5/0x540 > [58245.669829][T14017] path_setxattrat+0x364/0x3a0 > [58245.669840][T14017] ? __pfx_path_setxattrat+0x10/0x10 > [58245.669859][T14017] ? __se_sys_chdir+0x1b9/0x280 > [58245.669876][T14017] __x64_sys_lsetxattr+0xbf/0xe0 > [58245.669888][T14017] do_syscall_64+0xfa/0xfa0 > [58245.669901][T14017] ? lockdep_hardirqs_on+0x9c/0x150 > [58245.669913][T14017] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f > [58245.669927][T14017] ? exc_page_fault+0xab/0x100 > [58245.669937][T14017] entry_SYSCALL_64_after_hwframe+0x77/0x7f > > Reported-by: syzbot+4c1966e88c28fa96e053@syzkaller.appspotmail.com > Signed-off-by: Yun Zhou > --- > fs/jfs/jfs_dmap.c | 113 ++++++++++++++++++++++++++++++++++++++++++++-- > 1 file changed, 110 insertions(+), 3 deletions(-) > > diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c > index cdfa699cd7c8..3f1ed82baa3d 100644 > --- a/fs/jfs/jfs_dmap.c > +++ b/fs/jfs/jfs_dmap.c > @@ -133,6 +133,92 @@ static const s8 budtab[256] = { > 2, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, -1 > }; > > +/* > + * check_dmapctl - Validate integrity of a dmapctl structure > + * @dcp: Pointer to the dmapctl structure to check > + * > + * Return: true if valid, false if corrupted > + */ > +static bool check_dmapctl(struct dmapctl *dcp) > +{ > + s8 budmin = dcp->budmin; > + u32 nleafs, l2nleafs, leafidx, height; > + int i; > + > + nleafs = le32_to_cpu(dcp->nleafs); > + /* Check basic field ranges */ > + if (unlikely(nleafs > LPERCTL)) { > + jfs_err("dmapctl: invalid nleafs %u (max %u)", > + nleafs, LPERCTL); > + return false; > + } > + > + l2nleafs = le32_to_cpu(dcp->l2nleafs); > + if (unlikely(l2nleafs > L2LPERCTL)) { > + jfs_err("dmapctl: invalid l2nleafs %u (max %u)", > + l2nleafs, L2LPERCTL); > + return false; > + } > + > + /* Verify nleafs matches l2nleafs (must be power of two) */ > + if (unlikely((1U << l2nleafs) != nleafs)) { > + jfs_err("dmapctl: nleafs %u != 2^%u", > + nleafs, l2nleafs); > + return false; > + } > + > + leafidx = le32_to_cpu(dcp->leafidx); > + /* Check leaf index matches expected position */ > + if (unlikely(leafidx != CTLLEAFIND)) { > + jfs_err("dmapctl: invalid leafidx %u (expected %u)", > + leafidx, CTLLEAFIND); > + return false; > + } > + > + height = le32_to_cpu(dcp->height); > + /* Check tree height is within valid range */ > + if (unlikely(height > (L2LPERCTL >> 1))) { > + jfs_err("dmapctl: invalid height %u (max %u)", > + height, L2LPERCTL >> 1); > + return false; > + } > + > + /* Check budmin is valid (cannot be NOFREE for non-empty tree) */ > + if (budmin == NOFREE) { > + if (unlikely(nleafs > 0)) { > + jfs_err("dmapctl: budmin is NOFREE but nleafs %u", > + nleafs); > + return false; > + } > + } else if (unlikely(budmin < BUDMIN)) { > + jfs_err("dmapctl: invalid budmin %d (min %d)", > + budmin, BUDMIN); > + return false; > + } > + > + /* Check leaf nodes fit within stree array */ > + if (unlikely(leafidx + nleafs > CTLTREESIZE)) { > + jfs_err("dmapctl: leaf range exceeds stree size (end %u > %u)", > + leafidx + nleafs, CTLTREESIZE); > + return false; > + } > + > + /* Check leaf nodes have valid values */ > + for (i = leafidx; i < leafidx + nleafs; i++) { > + s8 val = dcp->stree[i]; > + if (unlikely(val < NOFREE)) { > + jfs_err("dmapctl: invalid leaf value %d at index %d", > + val, i); > + return false; > + } else if (unlikely(val > 31)) { > + jfs_err("dmapctl: leaf value %d too large at index %d", val, i); > + return false; > + } > + } > + > + return true; > +} > + > /* > * NAME: dbMount() > * > @@ -1372,7 +1458,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results) > dcp = (struct dmapctl *) mp->data; > budmin = dcp->budmin; > > - if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) { > + if (unlikely(!check_dmapctl(dcp))) { > jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n"); > release_metapage(mp); > return -EIO; > @@ -1702,7 +1788,7 @@ static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno) > dcp = (struct dmapctl *) mp->data; > budmin = dcp->budmin; > > - if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) { > + if (unlikely(!check_dmapctl(dcp))) { > jfs_error(bmp->db_ipbmap->i_sb, > "Corrupt dmapctl page\n"); > release_metapage(mp); > @@ -2485,7 +2571,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level) > return -EIO; > dcp = (struct dmapctl *) mp->data; > > - if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) { > + if (unlikely(!check_dmapctl(dcp))) { > jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n"); > release_metapage(mp); > return -EIO; > @@ -3454,6 +3540,11 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) > return -EIO; > } > l2dcp = (struct dmapctl *) l2mp->data; > + if (unlikely(!check_dmapctl(l2dcp))) { > + jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n"); > + release_metapage(l2mp); > + return -EIO; > + } > > /* compute start L1 */ > k = blkno >> L2MAXL1SIZE; > @@ -3471,6 +3562,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) > if (l1mp == NULL) > goto errout; > l1dcp = (struct dmapctl *) l1mp->data; > + if (unlikely(!check_dmapctl(l1dcp))) { > + jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n"); > + goto errout; > + } > > /* compute start L0 */ > j = (blkno & (MAXL1SIZE - 1)) >> L2MAXL0SIZE; > @@ -3484,6 +3579,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) > goto errout; > > l1dcp = (struct dmapctl *) l1mp->data; > + if (unlikely(!check_dmapctl(l1dcp))) { > + jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n"); > + goto errout; > + } > > /* compute start L0 */ > j = 0; > @@ -3503,6 +3602,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) > if (l0mp == NULL) > goto errout; > l0dcp = (struct dmapctl *) l0mp->data; > + if (unlikely(!check_dmapctl(l0dcp))) { > + jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n"); > + goto errout; > + } > > /* compute start dmap */ > i = (blkno & (MAXL0SIZE - 1)) >> > @@ -3518,6 +3621,10 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) > goto errout; > > l0dcp = (struct dmapctl *) l0mp->data; > + if (unlikely(!check_dmapctl(l0dcp))) { > + jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n"); > + goto errout; > + } > > /* compute start dmap */ > i = 0; Thank you for the patch. It also resolves the issue described in the link[1]. [1] https://lore.kernel.org/all/c201cbe0-5f52-4572-a04c-dc165eccff95@huawei.com/ Tested-by: Li Lingfeng