BUG: KASAN: slab-out-of-bounds in dtSearch+0x1d92/0x2000
Read of size 1 at addr ffff888134497f94 by task syz-executor.2/8793
CPU: 0 PID: 8793 Comm: syz-executor.2 Tainted: G W
6.0.0-07994-ge8bc52cb8df8 #9
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xcd/0x134
print_report.cold+0x2ba/0x719
kasan_report+0xb1/0x1e0
dtSearch+0x1d92/0x2000
jfs_lookup+0x17c/0x2f0
__lookup_slow+0x24c/0x460
walk_component+0x33f/0x5a0
link_path_walk.part.0.constprop.0+0x715/0xd80
path_lookupat+0x92/0x760
filename_lookup+0x1d2/0x590
user_path_at_empty+0x42/0x60
__x64_sys_chdir+0xb7/0x260
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The out-of-bounds access occurs in macro ciToUpper, which converts the
unicode character in ciKey.name into uppercase, this upper operation
will stop when it meets a terminal character(digit 0), so it needs to
set the last character to zero to ensure upper can stop in valid range.
Signed-off-by: Liao Chang <[email protected]>
---
fs/jfs/jfs_dtree.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 92b7c533407c..0c3af64abcfd 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -592,6 +592,7 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
/* uppercase search key for c-i directory */
UniStrcpy(ciKey.name, key->name);
ciKey.namlen = key->namlen;
+ ciKey.name[ciKey.namlen] = 0;
/* only uppercase if case-insensitive support is on */
if ((JFS_SBI(sb)->mntflag & JFS_OS2) == JFS_OS2) {
--
2.17.1