Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Liao Chang <liaochang1@huawei.com>
To:     <shaggy@kernel.org>
CC:     <jfs-discussion@lists.sourceforge.net>,
        <linux-kernel@vger.kernel.org>, <liaochang1@huawei.com>
Subject: [PATCH] jfs: Fix out-of-bounds access on dtSearch
Date:   Tue, 15 Nov 2022 10:30:09 +0800
Message-ID: <20221115023009.251044-1-liaochang1@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

BUG: KASAN: slab-out-of-bounds in dtSearch+0x1d92/0x2000
Read of size 1 at addr ffff888134497f94 by task syz-executor.2/8793

CPU: 0 PID: 8793 Comm: syz-executor.2 Tainted: G        W
6.0.0-07994-ge8bc52cb8df8 #9
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xcd/0x134
 print_report.cold+0x2ba/0x719
 kasan_report+0xb1/0x1e0
 dtSearch+0x1d92/0x2000
 jfs_lookup+0x17c/0x2f0
 __lookup_slow+0x24c/0x460
 walk_component+0x33f/0x5a0
 link_path_walk.part.0.constprop.0+0x715/0xd80
 path_lookupat+0x92/0x760
 filename_lookup+0x1d2/0x590
 user_path_at_empty+0x42/0x60
 __x64_sys_chdir+0xb7/0x260
 do_syscall_64+0x35/0x80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The out-of-bounds access occurs in macro ciToUpper, which converts the
unicode character in ciKey.name into uppercase, this upper operation
will stop when it meets a terminal character(digit 0), so it needs to
set the last character to zero to ensure upper can stop in valid range.

Signed-off-by: Liao Chang <liaochang1@huawei.com>
---
 fs/jfs/jfs_dtree.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 92b7c533407c..0c3af64abcfd 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -592,6 +592,7 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
 	/* uppercase search key for c-i directory */
 	UniStrcpy(ciKey.name, key->name);
 	ciKey.namlen = key->namlen;
+	ciKey.name[ciKey.namlen] = 0;
 
 	/* only uppercase if case-insensitive support is on */
 	if ((JFS_SBI(sb)->mntflag & JFS_OS2) == JFS_OS2) {
-- 
2.17.1