* [PATCH] jfs: fix array-index-out-of-bounds in dtInsertEntry
@ 2024-10-10 13:43 Ghanshyam Agrawal
2024-10-29 23:03 ` Dave Kleikamp
0 siblings, 1 reply; 4+ messages in thread
From: Ghanshyam Agrawal @ 2024-10-10 13:43 UTC (permalink / raw)
To: shaggy, osmtendev, ghandatmanas, eadavis, ghanshyam1898
Cc: jfs-discussion, linux-kernel, syzbot+5f7f0caf9979e9d09ff8
The value of p->header.freelist can be less than zero which
causes an error in dtInsertEntry. Added a check in dtInsert
to address it.
Reported-by: syzbot+5f7f0caf9979e9d09ff8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5f7f0caf9979e9d09ff8
Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
---
fs/jfs/jfs_dtree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 5d3127ca68a4..51bb3e14551b 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -834,7 +834,7 @@ int dtInsert(tid_t tid, struct inode *ip,
* the full page.
*/
DT_GETSEARCH(ip, btstack->top, bn, mp, p, index);
- if (p->header.freelist == 0)
+ if (p->header.freelist <= 0)
return -EINVAL;
/*
--
2.34.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] jfs: fix array-index-out-of-bounds in dtInsertEntry
2024-10-10 13:43 [PATCH] jfs: fix array-index-out-of-bounds in dtInsertEntry Ghanshyam Agrawal
@ 2024-10-29 23:03 ` Dave Kleikamp
2024-10-30 21:39 ` Dave Kleikamp
0 siblings, 1 reply; 4+ messages in thread
From: Dave Kleikamp @ 2024-10-29 23:03 UTC (permalink / raw)
To: Ghanshyam Agrawal, osmtendev, ghandatmanas, eadavis
Cc: jfs-discussion, linux-kernel, syzbot+5f7f0caf9979e9d09ff8
On 10/10/24 8:43AM, Ghanshyam Agrawal wrote:
> The value of p->header.freelist can be less than zero which
> causes an error in dtInsertEntry. Added a check in dtInsert
> to address it.
>
> Reported-by: syzbot+5f7f0caf9979e9d09ff8@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=5f7f0caf9979e9d09ff8
> Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
Looks good. I'll apply this one.
> ---
> fs/jfs/jfs_dtree.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
> index 5d3127ca68a4..51bb3e14551b 100644
> --- a/fs/jfs/jfs_dtree.c
> +++ b/fs/jfs/jfs_dtree.c
> @@ -834,7 +834,7 @@ int dtInsert(tid_t tid, struct inode *ip,
> * the full page.
> */
> DT_GETSEARCH(ip, btstack->top, bn, mp, p, index);
> - if (p->header.freelist == 0)
> + if (p->header.freelist <= 0)
> return -EINVAL;
>
> /*
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] jfs: fix array-index-out-of-bounds in dtInsertEntry
2024-10-29 23:03 ` Dave Kleikamp
@ 2024-10-30 21:39 ` Dave Kleikamp
2024-10-31 1:58 ` Ghanshyam Agrawal
0 siblings, 1 reply; 4+ messages in thread
From: Dave Kleikamp @ 2024-10-30 21:39 UTC (permalink / raw)
To: Ghanshyam Agrawal, osmtendev, ghandatmanas, eadavis
Cc: jfs-discussion, linux-kernel, syzbot+5f7f0caf9979e9d09ff8
On 10/29/24 6:03PM, Dave Kleikamp wrote:
> On 10/10/24 8:43AM, Ghanshyam Agrawal wrote:
>> The value of p->header.freelist can be less than zero which
>> causes an error in dtInsertEntry. Added a check in dtInsert
>> to address it.
>>
>> Reported-by: syzbot+5f7f0caf9979e9d09ff8@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=5f7f0caf9979e9d09ff8
>> Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
>
> Looks good. I'll apply this one.
Unapplying it. This caused regressions running xfstests. I'll need to
look into it more carefully.
Shaggy
>
>> ---
>> fs/jfs/jfs_dtree.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
>> index 5d3127ca68a4..51bb3e14551b 100644
>> --- a/fs/jfs/jfs_dtree.c
>> +++ b/fs/jfs/jfs_dtree.c
>> @@ -834,7 +834,7 @@ int dtInsert(tid_t tid, struct inode *ip,
>> * the full page.
>> */
>> DT_GETSEARCH(ip, btstack->top, bn, mp, p, index);
>> - if (p->header.freelist == 0)
>> + if (p->header.freelist <= 0)
>> return -EINVAL;
>> /*
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] jfs: fix array-index-out-of-bounds in dtInsertEntry
2024-10-30 21:39 ` Dave Kleikamp
@ 2024-10-31 1:58 ` Ghanshyam Agrawal
0 siblings, 0 replies; 4+ messages in thread
From: Ghanshyam Agrawal @ 2024-10-31 1:58 UTC (permalink / raw)
To: Dave Kleikamp
Cc: osmtendev, ghandatmanas, eadavis, jfs-discussion, linux-kernel,
syzbot+5f7f0caf9979e9d09ff8
On Thu, Oct 31, 2024 at 3:09 AM Dave Kleikamp <dave.kleikamp@oracle.com> wrote:
>
> On 10/29/24 6:03PM, Dave Kleikamp wrote:
> > On 10/10/24 8:43AM, Ghanshyam Agrawal wrote:
> >> The value of p->header.freelist can be less than zero which
> >> causes an error in dtInsertEntry. Added a check in dtInsert
> >> to address it.
> >>
> >> Reported-by: syzbot+5f7f0caf9979e9d09ff8@syzkaller.appspotmail.com
> >> Closes: https://syzkaller.appspot.com/bug?extid=5f7f0caf9979e9d09ff8
> >> Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
> >
> > Looks good. I'll apply this one.
>
> Unapplying it. This caused regressions running xfstests. I'll need to
> look into it more carefully.
>
> Shaggy
>
> >
> >> ---
> >> fs/jfs/jfs_dtree.c | 2 +-
> >> 1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
> >> index 5d3127ca68a4..51bb3e14551b 100644
> >> --- a/fs/jfs/jfs_dtree.c
> >> +++ b/fs/jfs/jfs_dtree.c
> >> @@ -834,7 +834,7 @@ int dtInsert(tid_t tid, struct inode *ip,
> >> * the full page.
> >> */
> >> DT_GETSEARCH(ip, btstack->top, bn, mp, p, index);
> >> - if (p->header.freelist == 0)
> >> + if (p->header.freelist <= 0)
> >> return -EINVAL;
> >> /*
>
Hello Dave,
Thank you for reviewing and testing my patch. Let me go through the
xfstests results, find the issue and send a v2 for this patch.
Thanks & Regards,
Ghanshyam Agrawal
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-10-31 1:59 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-10-10 13:43 [PATCH] jfs: fix array-index-out-of-bounds in dtInsertEntry Ghanshyam Agrawal
2024-10-29 23:03 ` Dave Kleikamp
2024-10-30 21:39 ` Dave Kleikamp
2024-10-31 1:58 ` Ghanshyam Agrawal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®