2021-01-20 01:40:15

by Gao Xiang

Subject: [PATCH] erofs: fix shift-out-of-bounds of blkszbits

From: Gao Xiang <[email protected]>

syzbot generated a crafted bitszbits which can be shifted
out-of-bounds[1]. So directly print unsupported blkszbits
instead of blksize.

[1] https://lore.kernel.org/r/[email protected]
Reported-by: [email protected]
Signed-off-by: Gao Xiang <[email protected]>
---
fs/erofs/super.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index be10b16ea66e..d5a6b9b888a5 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -158,8 +158,8 @@ static int erofs_read_superblock(struct super_block *sb)
blkszbits = dsb->blkszbits;
/* 9(512 bytes) + LOG_SECTORS_PER_BLOCK == LOG_BLOCK_SIZE */
if (blkszbits != LOG_BLOCK_SIZE) {
- erofs_err(sb, "blksize %u isn't supported on this platform",
- 1 << blkszbits);
+ erofs_err(sb, "blkszbits %u isn't supported on this platform",
+ blkszbits);
goto out;
}

--
2.24.0

2021-02-10 13:10:18

by Gao Xiang

Subject: Re: [PATCH] erofs: fix shift-out-of-bounds of blkszbits

Hi Chao,

On Wed, Jan 20, 2021 at 09:30:16AM +0800, Gao Xiang wrote:
> From: Gao Xiang <[email protected]>
>
> syzbot generated a crafted bitszbits which can be shifted
> out-of-bounds[1]. So directly print unsupported blkszbits
> instead of blksize.
>
> [1] https://lore.kernel.org/r/[email protected]
> Reported-by: [email protected]
> Signed-off-by: Gao Xiang <[email protected]>

Could you kindly review this trivial syzaller patch as well? Since
"erofs: initialized fields can only be observed after bit is set"
is somewhat serious on some weak-memory-order designed platforms
(no idea why our hisilison ARM64 platform didn't observe it before.)
I intended to prepare this for 5.13 cycle directly with ongoing
multi pcluster / LZMA in-kernel decompresion. But that regression
seems a bit important to upstream for the next 5.12 cycle....

Thanks,
Gao Xiang

> ---
> fs/erofs/super.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/erofs/super.c b/fs/erofs/super.c
> index be10b16ea66e..d5a6b9b888a5 100644
> --- a/fs/erofs/super.c
> +++ b/fs/erofs/super.c
> @@ -158,8 +158,8 @@ static int erofs_read_superblock(struct super_block *sb)
> blkszbits = dsb->blkszbits;
> /* 9(512 bytes) + LOG_SECTORS_PER_BLOCK == LOG_BLOCK_SIZE */
> if (blkszbits != LOG_BLOCK_SIZE) {
> - erofs_err(sb, "blksize %u isn't supported on this platform",
> - 1 << blkszbits);
> + erofs_err(sb, "blkszbits %u isn't supported on this platform",
> + blkszbits);
> goto out;
> }
>
> --
> 2.24.0
>

2021-02-11 01:20:53

by Chao Yu

Subject: Re: [PATCH] erofs: fix shift-out-of-bounds of blkszbits

On 2021/1/20 9:30, Gao Xiang via Linux-erofs wrote:
> From: Gao Xiang <[email protected]>
>
> syzbot generated a crafted bitszbits which can be shifted
> out-of-bounds[1]. So directly print unsupported blkszbits
> instead of blksize.
>
> [1] https://lore.kernel.org/r/[email protected]
> Reported-by: [email protected]
> Signed-off-by: Gao Xiang <[email protected]>

Sorry, I missed this patch.

Reviewed-by: Chao Yu <[email protected]>

Thanks,