From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from canpmsgout03.his.huawei.com (canpmsgout03.his.huawei.com [113.46.200.218]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 633E81F30A9 for ; Mon, 22 Dec 2025 12:05:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.218 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766405161; cv=none; b=gQrkN1ZzjpRZQPQNeHAra+ouauFvVG/vG2gHaYR1uGWJFG3kaioE5iXUxOhTGdBZMpWUhsaZv+x+gqZvVRhyuHLx6HX6ewrByyW/lTGLMiPuhNgrb5+Nzbc+vKPK3yU30kPv7yVKEzVYfqsQbhmoDYG21v1IpdkOK68xbmU/ARA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766405161; c=relaxed/simple; bh=9tVcvDrlzoDeMHqSaLLJ1C56f/aaQwTKO+/7DgOrMm8=; h=Message-ID:Date:MIME-Version:Subject:From:To:CC:References: In-Reply-To:Content-Type; b=Sod77XqauzBMXChkKz/Faf408Ihc13gMDXQkF3BxVE6MumTuHkPfPtXj32AY6qiXov3wZnAC33g07aT7+pefEnOZLIXh8wVwOyGWADKVz9gLxTcJ++9thb4DUObvZX9pPV0Gwh7ry7WTeSsZSnR9NGQeYlrldciLZmVQes2gX6o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=ajUj3NyE; arc=none smtp.client-ip=113.46.200.218 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="ajUj3NyE" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=qaGE/fAMDcDmun8f9l/BzfZ+3KgNysybg1VuM2OQVOM=; b=ajUj3NyEeVuh/b7F46CEXhB9sBmeZivooeex9N6rE3kA/jasodF5snqWJ0SCJ68QGD4c8ESW3 veozETPrdZ3Tz/xE/9ZxEsuqhRAMyReQ7HT4ag2Qs9FLvpwQnjH1qm+GLRIQywxbNhBNPyGsHN0 jVazQLvUwJ4tTuj7o+Ayoaw= Received: from mail.maildlp.com (unknown [172.19.162.140]) by canpmsgout03.his.huawei.com (SkyGuard) with ESMTPS id 4dZcGY23ggzpSy3; Mon, 22 Dec 2025 20:03:01 +0800 (CST) Received: from kwepemj200013.china.huawei.com (unknown [7.202.194.25]) by mail.maildlp.com (Postfix) with ESMTPS id 72858201E8; Mon, 22 Dec 2025 20:05:54 +0800 (CST) Received: from [10.174.179.155] (10.174.179.155) by kwepemj200013.china.huawei.com (7.202.194.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Mon, 22 Dec 2025 20:05:53 +0800 Message-ID: <686bc501-5263-4054-8cae-3529be86b9c5@huawei.com> Date: Mon, 22 Dec 2025 20:05:53 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: =?UTF-8?B?TW96aWxsYSBUaHVuZGVyYmlyZCDmtYvor5XniYg=?= Subject: Re: [PATCH v2] jfs: add dmapctl integrity check to prevent invalid operations From: Li Lingfeng To: Yun Zhou , CC: , , , , , , yangerkun , References: <20251128155150.1493986-1-yun.zhou@windriver.com> <2febd16b-77a3-45c7-80cb-e324d3540746@huawei.com> In-Reply-To: <2febd16b-77a3-45c7-80cb-e324d3540746@huawei.com> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit X-ClientProxiedBy: kwepems500001.china.huawei.com (7.221.188.70) To kwepemj200013.china.huawei.com (7.202.194.25) Friendly ping... Thanks 在 2025/11/29 9:15, Li Lingfeng 写道: > Hi Yun, > > 在 2025/11/28 23:51, Yun Zhou 写道: >> Add check_dmapctl() to validate dmapctl structure integrity, focusing on >> preventing invalid operations caused by on-disk corruption. >> >> Key checks: >>   - nleafs bounded by [0, LPERCTL] (maximum leaf nodes per dmapctl). >>   - l2nleafs bounded by [0, L2LPERCTL] and consistent with nleafs >>     (nleafs must be 2^l2nleafs). >>   - leafidx must be exactly CTLLEAFIND (expected leaf index position). >>   - height bounded by [0, L2LPERCTL >> 1] (valid tree height range). >>   - budmin validity: NOFREE only if nleafs=0; otherwise >= BUDMIN. >>   - Leaf nodes fit within stree array (leafidx + nleafs <= CTLTREESIZE). >>   - Leaf node values are either non-negative or NOFREE. >> >> Invoked in dbAllocAG(), dbFindCtl(), dbAdjCtl() and dbExtendFS() when >> accessing dmapctl pages, catching corruption early before dmap >> operations >> trigger invalid memory access or logic errors. >> >> This fixes the following UBSAN warning. >> >> [58245.668090][T14017] ------------[ cut here ]------------ >> [58245.668103][T14017] UBSAN: shift-out-of-bounds in >> fs/jfs/jfs_dmap.c:2641:11 >> [58245.668119][T14017] shift exponent 110 is too large for 32-bit >> type 'int' >> [58245.668137][T14017] CPU: 0 UID: 0 PID: 14017 Comm: 4c1966e88c28fa9 >> Tainted: G            E 6.18.0-rc4-00253-g21ce5d4ba045-dirty #124 >> PREEMPT_{RT,(full)} >> [58245.668174][T14017] Tainted: [E]=UNSIGNED_MODULE >> [58245.668176][T14017] Hardware name: QEMU Ubuntu 25.04 PC (i440FX + >> PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 >> [58245.668184][T14017] Call Trace: >> [58245.668200][T14017]  >> [58245.668208][T14017]  dump_stack_lvl+0x189/0x250 >> [58245.668288][T14017]  ? __pfx_dump_stack_lvl+0x10/0x10 >> [58245.668301][T14017]  ? __pfx__printk+0x10/0x10 >> [58245.668315][T14017]  ? lock_metapage+0x303/0x400 [jfs] >> [58245.668406][T14017]  ubsan_epilogue+0xa/0x40 >> [58245.668422][T14017] __ubsan_handle_shift_out_of_bounds+0x386/0x410 >> [58245.668462][T14017]  dbSplit+0x1f8/0x200 [jfs] >> [58245.668543][T14017]  dbAdjCtl+0x34c/0xa20 [jfs] >> [58245.668628][T14017]  dbAllocNear+0x2ee/0x3d0 [jfs] >> [58245.668710][T14017]  dbAlloc+0x933/0xba0 [jfs] >> [58245.668797][T14017]  ea_write+0x374/0xdd0 [jfs] >> [58245.668888][T14017]  ? __pfx_ea_write+0x10/0x10 [jfs] >> [58245.668966][T14017]  ? __jfs_setxattr+0x76e/0x1120 [jfs] >> [58245.669046][T14017]  __jfs_setxattr+0xa01/0x1120 [jfs] >> [58245.669135][T14017]  ? __pfx___jfs_setxattr+0x10/0x10 [jfs] >> [58245.669216][T14017]  ? mutex_lock_nested+0x154/0x1d0 >> [58245.669252][T14017]  ? __jfs_xattr_set+0xb9/0x170 [jfs] >> [58245.669333][T14017]  __jfs_xattr_set+0xda/0x170 [jfs] >> [58245.669430][T14017]  ? __pfx___jfs_xattr_set+0x10/0x10 [jfs] >> [58245.669509][T14017]  ? xattr_full_name+0x6f/0x90 >> [58245.669546][T14017]  ? jfs_xattr_set+0x33/0x60 [jfs] >> [58245.669636][T14017]  ? __pfx_jfs_xattr_set+0x10/0x10 [jfs] >> [58245.669726][T14017]  __vfs_setxattr+0x43c/0x480 >> [58245.669743][T14017]  __vfs_setxattr_noperm+0x12d/0x660 >> [58245.669756][T14017]  vfs_setxattr+0x16b/0x2f0 >> [58245.669768][T14017]  ? __pfx_vfs_setxattr+0x10/0x10 >> [58245.669782][T14017]  filename_setxattr+0x274/0x600 >> [58245.669795][T14017]  ? __pfx_filename_setxattr+0x10/0x10 >> [58245.669806][T14017]  ? getname_flags+0x1e5/0x540 >> [58245.669829][T14017]  path_setxattrat+0x364/0x3a0 >> [58245.669840][T14017]  ? __pfx_path_setxattrat+0x10/0x10 >> [58245.669859][T14017]  ? __se_sys_chdir+0x1b9/0x280 >> [58245.669876][T14017]  __x64_sys_lsetxattr+0xbf/0xe0 >> [58245.669888][T14017]  do_syscall_64+0xfa/0xfa0 >> [58245.669901][T14017]  ? lockdep_hardirqs_on+0x9c/0x150 >> [58245.669913][T14017]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f >> [58245.669927][T14017]  ? exc_page_fault+0xab/0x100 >> [58245.669937][T14017]  entry_SYSCALL_64_after_hwframe+0x77/0x7f >> >> Reported-by: syzbot+4c1966e88c28fa96e053@syzkaller.appspotmail.com >> Signed-off-by: Yun Zhou >> --- >>   fs/jfs/jfs_dmap.c | 113 ++++++++++++++++++++++++++++++++++++++++++++-- >>   1 file changed, 110 insertions(+), 3 deletions(-) >> >> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c >> index cdfa699cd7c8..3f1ed82baa3d 100644 >> --- a/fs/jfs/jfs_dmap.c >> +++ b/fs/jfs/jfs_dmap.c >> @@ -133,6 +133,92 @@ static const s8 budtab[256] = { >>       2, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, -1 >>   }; >>   +/* >> + * check_dmapctl - Validate integrity of a dmapctl structure >> + * @dcp: Pointer to the dmapctl structure to check >> + * >> + * Return: true if valid, false if corrupted >> + */ >> +static bool check_dmapctl(struct dmapctl *dcp) >> +{ >> +    s8 budmin = dcp->budmin; >> +    u32 nleafs, l2nleafs, leafidx, height; >> +    int i; >> + >> +    nleafs = le32_to_cpu(dcp->nleafs); >> +    /* Check basic field ranges */ >> +    if (unlikely(nleafs > LPERCTL)) { >> +        jfs_err("dmapctl: invalid nleafs %u (max %u)", >> +            nleafs, LPERCTL); >> +        return false; >> +    } >> + >> +    l2nleafs = le32_to_cpu(dcp->l2nleafs); >> +    if (unlikely(l2nleafs > L2LPERCTL)) { >> +        jfs_err("dmapctl: invalid l2nleafs %u (max %u)", >> +            l2nleafs, L2LPERCTL); >> +        return false; >> +    } >> + >> +    /* Verify nleafs matches l2nleafs (must be power of two) */ >> +    if (unlikely((1U << l2nleafs) != nleafs)) { >> +        jfs_err("dmapctl: nleafs %u != 2^%u", >> +            nleafs, l2nleafs); >> +        return false; >> +    } >> + >> +    leafidx = le32_to_cpu(dcp->leafidx); >> +    /* Check leaf index matches expected position */ >> +    if (unlikely(leafidx != CTLLEAFIND)) { >> +        jfs_err("dmapctl: invalid leafidx %u (expected %u)", >> +            leafidx, CTLLEAFIND); >> +        return false; >> +    } >> + >> +    height = le32_to_cpu(dcp->height); >> +    /* Check tree height is within valid range */ >> +    if (unlikely(height > (L2LPERCTL >> 1))) { >> +        jfs_err("dmapctl: invalid height %u (max %u)", >> +            height, L2LPERCTL >> 1); >> +        return false; >> +    } >> + >> +    /* Check budmin is valid (cannot be NOFREE for non-empty tree) */ >> +    if (budmin == NOFREE) { >> +        if (unlikely(nleafs > 0)) { >> +            jfs_err("dmapctl: budmin is NOFREE but nleafs %u", >> +                nleafs); >> +            return false; >> +        } >> +    } else if (unlikely(budmin < BUDMIN)) { >> +        jfs_err("dmapctl: invalid budmin %d (min %d)", >> +            budmin, BUDMIN); >> +        return false; >> +    } >> + >> +    /* Check leaf nodes fit within stree array */ >> +    if (unlikely(leafidx + nleafs > CTLTREESIZE)) { >> +        jfs_err("dmapctl: leaf range exceeds stree size (end %u > %u)", >> +            leafidx + nleafs, CTLTREESIZE); >> +        return false; >> +    } >> + >> +    /* Check leaf nodes have valid values */ >> +    for (i = leafidx; i < leafidx + nleafs; i++) { >> +        s8 val = dcp->stree[i]; >> +        if (unlikely(val < NOFREE)) { >> +            jfs_err("dmapctl: invalid leaf value %d at index %d", >> +                    val, i); >> +            return false; >> +        } else if (unlikely(val > 31)) { >> +            jfs_err("dmapctl: leaf value %d too large at index %d", >> val, i); >> +            return false; >> +        } >> +    } >> + >> +    return true; >> +} >> + >>   /* >>    * NAME:    dbMount() >>    * >> @@ -1372,7 +1458,7 @@ dbAllocAG(struct bmap * bmp, int agno, s64 >> nblocks, int l2nb, s64 * results) >>       dcp = (struct dmapctl *) mp->data; >>       budmin = dcp->budmin; >>   -    if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) { >> +    if (unlikely(!check_dmapctl(dcp))) { >>           jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n"); >>           release_metapage(mp); >>           return -EIO; >> @@ -1702,7 +1788,7 @@ static int dbFindCtl(struct bmap * bmp, int >> l2nb, int level, s64 * blkno) >>           dcp = (struct dmapctl *) mp->data; >>           budmin = dcp->budmin; >>   -        if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) { >> +        if (unlikely(!check_dmapctl(dcp))) { >>               jfs_error(bmp->db_ipbmap->i_sb, >>                     "Corrupt dmapctl page\n"); >>               release_metapage(mp); >> @@ -2485,7 +2571,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int >> newval, int alloc, int level) >>           return -EIO; >>       dcp = (struct dmapctl *) mp->data; >>   -    if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) { >> +    if (unlikely(!check_dmapctl(dcp))) { >>           jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n"); >>           release_metapage(mp); >>           return -EIO; >> @@ -3454,6 +3540,11 @@ int dbExtendFS(struct inode *ipbmap, s64 >> blkno,    s64 nblocks) >>           return -EIO; >>       } >>       l2dcp = (struct dmapctl *) l2mp->data; >> +    if (unlikely(!check_dmapctl(l2dcp))) { >> +        jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n"); >> +        release_metapage(l2mp); >> +        return -EIO; >> +    } >>         /* compute start L1 */ >>       k = blkno >> L2MAXL1SIZE; >> @@ -3471,6 +3562,10 @@ int dbExtendFS(struct inode *ipbmap, s64 >> blkno,    s64 nblocks) >>               if (l1mp == NULL) >>                   goto errout; >>               l1dcp = (struct dmapctl *) l1mp->data; >> +            if (unlikely(!check_dmapctl(l1dcp))) { >> +                jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n"); >> +                goto errout; >> +            } >>                 /* compute start L0 */ >>               j = (blkno & (MAXL1SIZE - 1)) >> L2MAXL0SIZE; >> @@ -3484,6 +3579,10 @@ int dbExtendFS(struct inode *ipbmap, s64 >> blkno,    s64 nblocks) >>                   goto errout; >>                 l1dcp = (struct dmapctl *) l1mp->data; >> +            if (unlikely(!check_dmapctl(l1dcp))) { >> +                jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n"); >> +                goto errout; >> +            } >>                 /* compute start L0 */ >>               j = 0; >> @@ -3503,6 +3602,10 @@ int dbExtendFS(struct inode *ipbmap, s64 >> blkno,    s64 nblocks) >>                   if (l0mp == NULL) >>                       goto errout; >>                   l0dcp = (struct dmapctl *) l0mp->data; >> +                if (unlikely(!check_dmapctl(l0dcp))) { >> +                    jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n"); >> +                    goto errout; >> +                } >>                     /* compute start dmap */ >>                   i = (blkno & (MAXL0SIZE - 1)) >> >> @@ -3518,6 +3621,10 @@ int dbExtendFS(struct inode *ipbmap, s64 >> blkno,    s64 nblocks) >>                       goto errout; >>                     l0dcp = (struct dmapctl *) l0mp->data; >> +                if (unlikely(!check_dmapctl(l0dcp))) { >> +                    jfs_error(ipbmap->i_sb, "Corrupt dmapctl page\n"); >> +                    goto errout; >> +                } >>                     /* compute start dmap */ >>                   i = 0; > > Thank you for the patch. > It also resolves the issue described in the link[1]. > [1] > https://lore.kernel.org/all/c201cbe0-5f52-4572-a04c-dc165eccff95@huawei.com/ > > Tested-by: Li Lingfeng >