* [PATCH] jfs : fix shift-out-of-bounds in dbUpdatePMap
@ 2023-08-27 5:05 Manas Ghandat
2023-08-29 17:49 ` Dave Kleikamp
0 siblings, 1 reply; 4+ messages in thread
From: Manas Ghandat @ 2023-08-27 5:05 UTC (permalink / raw)
To: shaggy, liushixin2
Cc: Manas Ghandat, jfs-discussion, linux-kernel,
Linux-kernel-mentees, syzbot+91ad2b52815a08caf4ea
Currently there is no bound check for number of logical blocks per
page (bmp->db_l2nbperpage). Added the required bound check for the
calculation of dmap.
Reported-by: syzbot+91ad2b52815a08caf4ea@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=91ad2b52815a08caf4ea
Fixes: 4d81715fc5df ("[PATCH] fs/jfs: Conversion to generic boolean")
Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
---
fs/jfs/jfs_dmap.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index a3eb1e826947..6a5df296fdc8 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -467,6 +467,10 @@ dbUpdatePMap(struct inode *ipbmap,
lastlblkno = 0;
for (rem = nblocks; rem > 0; rem -= nblks, blkno += nblks) {
/* get the buffer for the current dmap. */
+
+ if (bmp->db_l2nbperpage > L2BPERDMAP)
+ return -EIO;
+
lblkno = BLKTODMAP(blkno, bmp->db_l2nbperpage);
if (lblkno != lastlblkno) {
if (mp) {
--
2.37.2
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] jfs : fix shift-out-of-bounds in dbUpdatePMap
2023-08-27 5:05 [PATCH] jfs : fix shift-out-of-bounds in dbUpdatePMap Manas Ghandat
@ 2023-08-29 17:49 ` Dave Kleikamp
2023-08-30 16:58 ` Manas Ghandat
0 siblings, 1 reply; 4+ messages in thread
From: Dave Kleikamp @ 2023-08-29 17:49 UTC (permalink / raw)
To: Manas Ghandat, liushixin2
Cc: jfs-discussion, linux-kernel, Linux-kernel-mentees,
syzbot+91ad2b52815a08caf4ea
On 8/27/23 12:05AM, Manas Ghandat wrote:
> Currently there is no bound check for number of logical blocks per
> page (bmp->db_l2nbperpage). Added the required bound check for the
> calculation of dmap.
This should already be fixed by 11509910c599 ("jfs: jfs_dmap: Validate
db_l2nbperpage while mounting")
Can you please verify if this problem still exists in v6.5?
Shaggy
>
> Reported-by: syzbot+91ad2b52815a08caf4ea@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=91ad2b52815a08caf4ea
> Fixes: 4d81715fc5df ("[PATCH] fs/jfs: Conversion to generic boolean")
> Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
> ---
> fs/jfs/jfs_dmap.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index a3eb1e826947..6a5df296fdc8 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -467,6 +467,10 @@ dbUpdatePMap(struct inode *ipbmap,
> lastlblkno = 0;
> for (rem = nblocks; rem > 0; rem -= nblks, blkno += nblks) {
> /* get the buffer for the current dmap. */
> +
> + if (bmp->db_l2nbperpage > L2BPERDMAP)
> + return -EIO;
> +
> lblkno = BLKTODMAP(blkno, bmp->db_l2nbperpage);
> if (lblkno != lastlblkno) {
> if (mp) {
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] jfs : fix shift-out-of-bounds in dbUpdatePMap
2023-08-29 17:49 ` Dave Kleikamp
@ 2023-08-30 16:58 ` Manas Ghandat
2023-08-30 20:20 ` Dave Kleikamp
0 siblings, 1 reply; 4+ messages in thread
From: Manas Ghandat @ 2023-08-30 16:58 UTC (permalink / raw)
To: Dave Kleikamp, liushixin2
Cc: jfs-discussion, linux-kernel, Linux-kernel-mentees,
syzbot+91ad2b52815a08caf4ea
I checked for the v6.5. Its fixed there.
On 29/08/23 23:19, Dave Kleikamp wrote:
> On 8/27/23 12:05AM, Manas Ghandat wrote:
>> Currently there is no bound check for number of logical blocks per
>> page (bmp->db_l2nbperpage). Added the required bound check for the
>> calculation of dmap.
>
> This should already be fixed by 11509910c599 ("jfs: jfs_dmap: Validate
> db_l2nbperpage while mounting")
>
> Can you please verify if this problem still exists in v6.5?
>
> Shaggy
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] jfs : fix shift-out-of-bounds in dbUpdatePMap
2023-08-30 16:58 ` Manas Ghandat
@ 2023-08-30 20:20 ` Dave Kleikamp
0 siblings, 0 replies; 4+ messages in thread
From: Dave Kleikamp @ 2023-08-30 20:20 UTC (permalink / raw)
To: Manas Ghandat, liushixin2
Cc: jfs-discussion, linux-kernel, Linux-kernel-mentees,
syzbot+91ad2b52815a08caf4ea
Thanks for verifying!
On 8/30/23 11:58AM, Manas Ghandat wrote:
> I checked for the v6.5. Its fixed there.
>
> On 29/08/23 23:19, Dave Kleikamp wrote:
>> On 8/27/23 12:05AM, Manas Ghandat wrote:
>>> Currently there is no bound check for number of logical blocks per
>>> page (bmp->db_l2nbperpage). Added the required bound check for the
>>> calculation of dmap.
>>
>> This should already be fixed by 11509910c599 ("jfs: jfs_dmap: Validate
>> db_l2nbperpage while mounting")
>>
>> Can you please verify if this problem still exists in v6.5?
>>
>> Shaggy
>>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-08-30 22:10 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-27 5:05 [PATCH] jfs : fix shift-out-of-bounds in dbUpdatePMap Manas Ghandat
2023-08-29 17:49 ` Dave Kleikamp
2023-08-30 16:58 ` Manas Ghandat
2023-08-30 20:20 ` Dave Kleikamp
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®