Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <11ce83d5-6080-5474-02de-677a4116405d@oracle.com>
Date:   Tue, 22 Mar 2022 10:25:52 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.7.0
Subject: Re: [PATCH v2] jfs: fix divide error in dbNextAG
Content-Language: en-US
To:     Pavel Skripkin <paskripkin@gmail.com>, shaggy@kernel.org
Cc:     jfs-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org,
        syzbot+46f5c25af73eb8330eb6@syzkaller.appspotmail.com
References: <20220319191620.32372-1-paskripkin@gmail.com>
 <20220319193000.6449-1-paskripkin@gmail.com>
From:   Dave Kleikamp <dave.kleikamp@oracle.com>
In-Reply-To: <20220319193000.6449-1-paskripkin@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?dkpiUzJ6MytWbFVuT1ZoTDIvb1hLS0pUOUhCdHhGQXVJYWJYYVVpVlZlNjNE?=
 =?utf-8?B?RWdCNzFhcmdnWUdrMFFrRDR1WFRVaXJQdk10SDhUY0xDQzQ3VEJhYVVNVEdY?=
 =?utf-8?B?azhKU2E0eFhybW1DT253NnFudmloUEd2Zmk3Z3VDK3JhTUtsMjdYeTUwTG0y?=
 =?utf-8?B?SGNaUDllMU5zYUR3MU5oNUQvR1BIY0kwNlU0VTRmQjFtUzVnNmJhbmVUd1Qz?=
 =?utf-8?B?bjI1UlhGUlpYVTdWc3BDNXZiYUplbkhZTWpWYTJ4dmhDQ1h2VkdERENlRmMy?=
 =?utf-8?B?d2UyWXd0OU1iR1BsdjBYbVRmWTZsd1FOcEhKSUpYVmIyd2xhaGpPcVlLUENO?=
 =?utf-8?B?eGk1Z2c4SFhTWG14NGNzNkROOERUTjh2eG1WL0FDV1JidnE0OUVJRFJRU2dQ?=
 =?utf-8?B?SzUzbzQwZklDRmxLRStTOEtWNWc4OUVhenR4Y0t6dlYzUEpzcWlvK0tnUjYx?=
 =?utf-8?B?UW5CK0RpOVN6ampSVGtlNUR2ZWFEcTZoSTBQNE1NWGRYSUlnQU1IaWZsSDc5?=
 =?utf-8?B?anpVdjd3ajlCVkN5RmI1bWpBbmh3N0NrdTM2bFY5RjZtSU1OTEFVdllGWFk5?=
 =?utf-8?B?eDkyTUtpT0VVZzNhdnYrVFp6V0tDaU9obnBHbGVUWVRUWDlCbWJWYURVRjNO?=
 =?utf-8?B?WmtEeG16L1J0Wjc1dE1keWJxdHdDUmxwcWhFdXVtb0hyNTdaeENZSGwwazJo?=
 =?utf-8?B?Z2dKYituSG9DUkZBZ2dXU0t4UXVrNEFaYnpKVXRJZnBnWElORjZERE1nUGdz?=
 =?utf-8?B?M3R2S2hEakNKOC9ZQmMwcldhQndvdzN3YjBTdGRtVCtUOHJVNEFMZG03WGpW?=
 =?utf-8?B?SUlia0NLazVreDM4OHpUdUNhV1ZBOE9LNnRZczJGeVZnYVQzZ0NIR2FwVXpU?=
 =?utf-8?B?NXNUUU5UTW9iVFVpL2UyQm1hRzZSOW5xU056dmhBaXlnSkR2ZWxIV3llb1RN?=
 =?utf-8?B?dnRodjJQcTJFa204bk4xUnBRQW9sVmhvd2t5aGo3M0NhMmpMOE1FdDQ2SHhp?=
 =?utf-8?B?NzJZUEdlSEVpVXFSVmxPbHhhK1dKNXhDRjJjM1FudVpJeGZKTENVK3M2cXVT?=
 =?utf-8?B?Rlc1UGNUanFKc05IRElVUCtzZE9wd3pTZ0VYUlQzdEg2SHdvVWlEYTE3d0pB?=
 =?utf-8?B?Ykd2djNQdkxTaVgwQjNmUlBJMktYNTFnOWJHTGUwd1ljaGFwY1d0RHV3N3ZC?=
 =?utf-8?B?MkdnTmdBNTgwa1ZabC9qQ0kySUdmYm9UK1lVVG1nSDRYdVFuRHpSalJ5NjV3?=
 =?utf-8?B?VFhYNUVDRXp5cW1aenJKK2ZwVGx5NWVwVHp5RnM3cld0Z0ZTUm8yM3cvcVVi?=
 =?utf-8?B?a0JQeGNIM21nckUyT3F0YVg4UGt4dXU1MmxERk1CUXlDV1ZCeXpZekRmMWxm?=
 =?utf-8?B?U3lCZjZzSkZpVGRsUkdpK0tLaDFSK3pmYUt5L1hMekdDcGRLY0NGYnc5WkpH?=
 =?utf-8?B?ZFdmTnVzL1JUNkdqSlllQ21Lb2hJaHJISVdYenp0VWs5ZVh2Zi96OTN2ZTBG?=
 =?utf-8?B?TGF2UmdFLzBadHN4RDZRNkg5ajJRSFk0RjA0dHJoTDZJcUFXdHkvbmpRVE5R?=
 =?utf-8?B?d1dUUitBb3pnbUFkc0FqdzZQWUhEWmlFU0dUMThUSmZXV2hXcWk5UHZzUVdm?=
 =?utf-8?B?a3VRdmcyc1RqNmFKT1J1WFBWRGkvT1hqV2s1OS9EUVVSOG9kaHlvcDhNRnJv?=
 =?utf-8?B?U01ONzNzRzRBRjNGZnNZL25QWHdvSmRKWEdaS21lWWtyd0VMSXo4MFVwaUsr?=
 =?utf-8?B?VEtuM3BDNERjaWNwaUYrbWN4SHIzTHFZNUNiM0N4K2VRMGtUeDlRQXYzSUx1?=
 =?utf-8?B?SVZlNUhYblZ5bDR3QVBsdmlYTnUrUVkxTms1ai9DQ2NsbHhTY2luTzIvU2Jq?=
 =?utf-8?B?Nlp1ZUZWMStqdnk0cUliM1BoOVBzUTAxWVhBRW9GSnJZYkxraFZZTXJaVW9o?=
 =?utf-8?B?WklwSkVTSE9EMXFJS1dXZysyZTFVTTdrUDM3bGZTMDRocmhoWXZUNzlUZndH?=
 =?utf-8?B?aUw3OVVPc2NRPT0=?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 52d15071-accc-403e-1949-08da0c184199
X-MS-Exchange-CrossTenant-AuthSource: MW5PR10MB5738.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Mar 2022 15:25:54.7522
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 7GXy98kVaED8JTRx9r0xRe2eA6oVRyfqPD7FtgJ4jEqqfeQFtHnPN2JmzXFkohkUd0Ml6XzHG47kmmEN5Vy8sKSbGs3GC9Ya4dx9vU2a3fQ=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR10MB4076
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10294 signatures=694350
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 spamscore=0 malwarescore=0
 suspectscore=0 mlxlogscore=999 bulkscore=0 phishscore=0 mlxscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000
 definitions=main-2203220088
X-Proofpoint-GUID: VZr7vX5VASd_yR5_myoM1eY3yZVbjA64
X-Proofpoint-ORIG-GUID: VZr7vX5VASd_yR5_myoM1eY3yZVbjA64
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Thanks. I'll push this for 5.18.

Shaggy

On 3/19/22 2:30PM, Pavel Skripkin wrote:
> Syzbot reported divide error in dbNextAG(). The problem was in missing
> validation check for malicious image.
> 
> Syzbot crafted an image with bmp->db_numag equal to 0. There wasn't any
> validation checks, but dbNextAG() blindly use bmp->db_numag in divide
> expression
> 
> Fix it by validating bmp->db_numag in dbMount() and return an error if
> image is malicious
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-and-tested-by: syzbot+46f5c25af73eb8330eb6@syzkaller.appspotmail.com
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
> ---
> 
> Changes since v1:
> 	- Add missing clean up in case of error
> 
> ---
>   fs/jfs/jfs_dmap.c | 7 +++++++
>   1 file changed, 7 insertions(+)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index 91f4ec93dab1..d8502f4989d9 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -148,6 +148,7 @@ static const s8 budtab[256] = {
>    *	0	- success
>    *	-ENOMEM	- insufficient memory
>    *	-EIO	- i/o error
> + *	-EINVAL - wrong bmap data
>    */
>   int dbMount(struct inode *ipbmap)
>   {
> @@ -179,6 +180,12 @@ int dbMount(struct inode *ipbmap)
>   	bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree);
>   	bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage);
>   	bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
> +	if (!bmp->db_numag) {
> +		release_metapage(mp);
> +		kfree(bmp);
> +		return -EINVAL;
> +	}
> +
>   	bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel);
>   	bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag);
>   	bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref);