Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <d999bec5-a732-21fc-2136-dac1002372d6@oracle.com>
Date:   Thu, 27 Oct 2022 17:36:01 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.4.0
Subject: Re: [PATCH V2] fs: jfs: fix shift-out-of-bounds in dbDiscardAG
Content-Language: en-US
To:     Hoi Pok Wu <wuhoipok@gmail.com>
Cc:     jfs-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org,
        syzbot+f0e0fcf3cd1047ae60ad@syzkaller.appspotmail.com,
        syzkaller-bugs@googlegroups.com
References: <20221025152045.343650-1-wuhoipok@gmail.com>
From:   Dave Kleikamp <dave.kleikamp@oracle.com>
In-Reply-To: <20221025152045.343650-1-wuhoipok@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?b0lhMlFkTW1Oa2hncmFneGl4enlTY01kTkRVVm12SlZhNXlzTkJIRXUwWE0y?=
 =?utf-8?B?NGpnd1V6UDRYdElSNlB1VnlyTnRKZFJnNHlUSytkT0xSVGNKTlRoOGVCd3J6?=
 =?utf-8?B?dW1lVEFwdWZNOFZrRkRKM0VHalRqL1JWVWFqa1pjQUpNMlpHaWdzUDRQUWRo?=
 =?utf-8?B?KzFtYTZseGQ5YUlPSWYra2pJUldFVTk2L2ZUSjNrMmJkUHFTN0p3eStuZ29x?=
 =?utf-8?B?bnhhbWVVQzc3NTBTVC9YUU9nL2hQdWxBL2drZ0ZaTGNqb3M2djRvZHZlOXFy?=
 =?utf-8?B?T3lCK3NHMURORXZNd2pld1hjdjN2bk5MV0dneTFOS2EzTFQrR1EwMHQ4MVha?=
 =?utf-8?B?Q0FhSXY2YW55OXJtNmFqWmNLR25DWW1aanJOdDlFYW04YXlzbjJ5enpJeXJ4?=
 =?utf-8?B?WUp1L0lSMFBIRUl0cXg4bXB4WW5UY1orVVZ3cEdUc3R2aWh4YWVOcmJ2VlRR?=
 =?utf-8?B?WGtaZzdrc2svTk5ONEdKT1VMNThWdFEzanFIUnE0Rm1MMzl6Qk9ydGNBU2Fy?=
 =?utf-8?B?RktramhNWnBsOGRZNkRLQVRvN2JYS0c0Qk5DQ1VmL2YzWjNWRmcvRjJBSWE2?=
 =?utf-8?B?MFFrNnNYNmNQZUp3V2ZkbmFqcVhIUk1Wb0x3Uml4RE12YUdCVjdxTEtiRC9z?=
 =?utf-8?B?dURacGRpY3pXbnhpWkxIb3FtM2pyUkg4bjhrTzVFNzArM0lEQUhjV0ZVc0Ux?=
 =?utf-8?B?Z1lHU3U5OCtydHlmTmVjRk1lK2pQWXo4TzJTbTZkTW9HRjNOczU5Y3d0R2ZB?=
 =?utf-8?B?LzM4WWYvQ3l5cm00cTJneGdXQ3gxd0hZY1g5T1FuMjIwejhUWHZIL29BMFp6?=
 =?utf-8?B?dHQxNWpOSDNnZGVWMWdnS1RwejhmdWNjaTEwNXpXVTJaUXE2OWpYdlpPT1Rx?=
 =?utf-8?B?ZERmWTA5UTFrclA2dWZxYTQ3ZnIrY0t5U2VrSzhINUhna2o3R2V2TWNjbzVm?=
 =?utf-8?B?K0tlMWN5RUx4dlkzRWVXTFo4QmtVSkh3cXliYTEveStEb1lJNUZjNE8rd0ha?=
 =?utf-8?B?RGJSTW9JYXJibGgzclV1SjJaeVVqdFZlT2pXaEE2bUhxZ2YzZGdnTEpEU2Zs?=
 =?utf-8?B?S0VCVGhQOUJXdEY2RXNoRTFWTWJodGVGNjZDYUh3eDkrL2pWRS9rWURacUlC?=
 =?utf-8?B?OEhsS0RzRTNsdEZ1OGxHdXg2UXF6R2VvTTF6ek9pS2VBKzMvVnVBWjB5VXlt?=
 =?utf-8?B?b3o3Ni9HRnVjSmxSdDRjNmhaOGI0SUhPWFpFRzkxck5SRWNZQkR2dWlLRm5I?=
 =?utf-8?B?djVHYncyNUVsZ1Axc0hSbXB5cjNXS045RkhYWlpKaEtTbXJLa2RsWVpNeXBn?=
 =?utf-8?B?akxNSHlVR254YVpnS1J0aGZLYmFmK2J3N0xZNEFwMGpIV0hZcVdQdmREWXpO?=
 =?utf-8?B?NU9PZGVXTlhITnRveURSRy9mUS9GUTlsQlorMTdYVGp6YVI0TEdiNzdFUkIw?=
 =?utf-8?B?QlptRVNER1Nmd0pjTS9wb09Ya0kxVzJLSlNXR1ZjV3Q0MmhkYy9tRWRjc3Fp?=
 =?utf-8?B?NHFLeW1hTzZBOTEzSzF3TnhveFBMNGpkRFFGbitWdjkyaUpMRzRROXZXOWRy?=
 =?utf-8?B?VHVoZFg4L0tRdUpWMlBORE92MUlRcjcrNmVoMyszTHZ5bXQ4OTd1NmdIS1k1?=
 =?utf-8?B?Y2c0S0h5aTNsSnhtN0JpNjVzWkx5R1A3emVKaXFabVVGZzZjbi8yRXNZU0lu?=
 =?utf-8?B?ZXNBcW9RU1RuMTA4Umh3dEFsZjA0Skp5Y0cwalJvcnEzRWx0bGlwUUl0aWFv?=
 =?utf-8?B?UVNqSHJkV0xHQzFPYk9VODF0Si9BdEZpN3I5NkxrVEpvRklBdHBid2phUy9z?=
 =?utf-8?B?a2tzUi9BOHlha3lhZDZ0b3FpTlBIdkc5azVXd2U2MGN3cDBSK0U3QzBiYWJn?=
 =?utf-8?B?bVFqaFNGVTAzZDFxNCtMRldmN0pFQTFYSFdXNkhYVjdCYW5QWk9TcmpWWkhS?=
 =?utf-8?B?UzRKdmd5U3VNSGM5UGRvZDVURVczeEgxQk1QRkZHdGw4THRCY0M2OTNUZU84?=
 =?utf-8?B?NGhtdTJlaExtUEZYdWhHTDJQU2lJUFBXcitOdDBDRFdwR0tTU29jYU16ZlF2?=
 =?utf-8?B?dm12ZW1ndE10ZTFyZ3QwbEp1c3d6L2tRV0JqWVdscDNpL0NwQk0vN1d4OW00?=
 =?utf-8?B?L3RBalpMNjI4OXNUSUhhUzRxckcxWjdFTEhaL1ZUOCtRZFUrTVNQZDJiRkd6?=
 =?utf-8?B?U2c9PQ==?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1d031447-4fcb-4770-1977-08dab86ba1c6
X-MS-Exchange-CrossTenant-AuthSource: MW5PR10MB5738.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Oct 2022 22:36:04.3034
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: SlIcM3P6VImyTnxpRQE3LJu6CTVUhpAIw/+qaB9e2okuIWoCdAb48Is8cuWpEoPpI0U4dFTzMdzLywFms7+OuvuHKBMq+lGgmK/xd6biK6M=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB7008
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-10-27_07,2022-10-27_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxscore=0 mlxlogscore=979
 spamscore=0 phishscore=0 bulkscore=0 malwarescore=0 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000
 definitions=main-2210270127
X-Proofpoint-ORIG-GUID: LS6WMVLrqs14Mh-4gjaxqxx9pkQgHCRm
X-Proofpoint-GUID: LS6WMVLrqs14Mh-4gjaxqxx9pkQgHCRm
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Applied.

Thanks,
Shaggy

On 10/25/22 10:20AM, Hoi Pok Wu wrote:
> This should be applied to most URSAN bugs found recently by syzbot,
> by guarding the dbMount. As syzbot feeding rubbish into the bmap
> descriptor.
> 
> Signed-off-by: Hoi Pok Wu <wuhoipok@gmail.com>
> ---
> V1->2: guarding the corrupted data structure from dbMount instead
>   fs/jfs/jfs_dmap.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index e1cbfbb60303..765838578a72 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -198,6 +198,11 @@ int dbMount(struct inode *ipbmap)
>   		goto err_release_metapage;
>   	}
>   
> +	if (((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) {
> +		err = -EINVAL;
> +		goto err_release_metapage;
> +	}
> +
>   	for (i = 0; i < MAXAG; i++)
>   		bmp->db_agfree[i] = le64_to_cpu(dbmp_le->dn_agfree[i]);
>   	bmp->db_agsize = le64_to_cpu(dbmp_le->dn_agsize);