Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <489b3fbf-cd75-0e23-1cce-b34d84f67451@oracle.com>
Date:   Tue, 20 Jun 2023 12:43:54 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.12.0
Subject: Re: [PATCH v3] jfs: jfs_dmap: Validate db_l2nbperpage while mounting
To:     Siddh Raman Pant <code@siddh.me>,
        Dave Kleikamp <shaggy@kernel.org>,
        Hoi Pok Wu <wuhoipok@gmail.com>,
        Liu Shixin <liushixin2@huawei.com>,
        Dongliang Mu <mudongliangabcd@gmail.com>
Cc:     jfs-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org,
        syzbot+d2cd27dcf8e04b232eb2@syzkaller.appspotmail.com,
        stable@vger.kernel.org
References: <20230620164700.11083-1-code@siddh.me>
Content-Language: en-US
From:   Dave Kleikamp <dave.kleikamp@oracle.com>
In-Reply-To: <20230620164700.11083-1-code@siddh.me>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?dkNaeWRwUk5EV1dPQi9sbTlGRTlUamk5UDk5Y09yUmN4QTgrOGZVTDZjMmhD?=
 =?utf-8?B?ZlJSNVlmZVZPN2Y0eE5nV2dWMWFzaGtia2Ztb1d6RGJGYlloc1dBWEwzcFlK?=
 =?utf-8?B?cUtSUlhqdFJkaUFBRlFzQjhhMEJheEdla0NTYVNianBXTzZpWC9sOFlrNFZs?=
 =?utf-8?B?VzNFR2dTdTI2akhoNlhuU2J1WXl1UnFtbXpaZmY1TVBKbE9rK1VRdElaa2hi?=
 =?utf-8?B?c2hRVW9BV0w2alZKbVgvNTc0dmhSUmNyeDIyL0poaXhqcWxKakc5VnlTeWZJ?=
 =?utf-8?B?RjFLNTRsV3NCcU1vYUpXeG4yNEVCNmtHQzM0Wms3cTBZVUxxZTRZMGpuMUhC?=
 =?utf-8?B?NzNCRjlFYnlrZEtya2E3OTBQRjZzUFQycmFwazJZUmRvTGJCcmdia1JDOUFv?=
 =?utf-8?B?T1V4RFJnS1FQa25HNG4zR1IvN1JYb0Y3QSs2RXdUS2lZOEZua0l6V05rOE5q?=
 =?utf-8?B?VWlmTndDK3U0Um05cUFET2U0Ty8vZ2trcG5OSWt6bDhqWlBYOUFjbnRpVjRy?=
 =?utf-8?B?dVYzZUJOcUhwM1V3N0pEZWlld2tMZFExcVNkSk1OSFdlWDBMdmZZVkM5cVlQ?=
 =?utf-8?B?TVRBeG0rUVZNYVNjNTlCQVBsVG5rS04ybjA1QXd0V0NMQzV1MUhSVDZWbUta?=
 =?utf-8?B?cFZ5L0c4RlZLSTc5MXFBckdPTWtDUzVXelZiOHhiN3JRQXBsSWppRFZWSkZh?=
 =?utf-8?B?SnJYeVNwekNxN1ZoczBqa2JlNDJSRU9rTmJpa3B2NnBqd1BWRExhM0ptdUFU?=
 =?utf-8?B?NUpMK2xONDNkamZvNzhzWlprVGNuZ0hsVkx1MXFmeVpFNFlXOUw0V05VNjA2?=
 =?utf-8?B?TVRsUWlYOGFoVXQzZzhDeWNuTDJDdkJuZW9xMnhHQXp1cE1JUERPbjlFRmpj?=
 =?utf-8?B?N25jc1dONlZZUkVFL1NUU3lJWG9kUForcmY4b2llU0IzMDUrNTI3M3B6bUdD?=
 =?utf-8?B?TWdKVmtOOEs4b1FHdEhPQXcyWmVqR3E0MzRLNGRObVc4dWZHTUUrWUNacGdI?=
 =?utf-8?B?SzhudFZMSktWalBtVGpFZUJTczF3eTlmMVBYTStTQ1VpVkFGWnhSc3lEaEtX?=
 =?utf-8?B?QzcrMks1eituU2h0Rmt0MzJUbnprZnY2c0ZqbmNQdGljVFhFeER1YnZtcStS?=
 =?utf-8?B?anVpU2wzcGxjVHRNR2wrcFRma3h3K0wzT3lkMTFOUGxkQ29sSGk2QytZMFhJ?=
 =?utf-8?B?MHoyZmRkM0dhRkhBcDlSaWl4enNyQjlJekhhLzhKN0t0Z0o2bEFNaWZjWkhi?=
 =?utf-8?B?RVh1WmxsbVNLTlM4c2lMWkI5ZExxZkZ4V1dyZ205N2tlWWJ2eWc4Q1RUT24y?=
 =?utf-8?B?L2pYRGMyUmc3YUZVanZ1SWVNUHBXUitnai8xWVVIV281RUpGTXAyL3VyZWt3?=
 =?utf-8?B?cWtYMFBPVktQdlJJSkhhL0dNamhSbVYrM2Fka3hDWE9GR3YwRUpBU29wdWtv?=
 =?utf-8?B?czVNZGtxYjNaMmhqVXRIWXRsblpDQUpKWFRNRW85N3hNNURVTWtJQmt3TU9W?=
 =?utf-8?B?VEtOU0VQbkxhcXpEbDBDT3VDL2VwQWphc1E3cUtGZjl1Y3lxZzBiVlVIaFYv?=
 =?utf-8?B?ODV0RXI0bWt1MWlPejNzNlFTaXF0QWRzVXZPQ29zN0MvZnlraFpXMlY3UG85?=
 =?utf-8?B?eXllNmdWaDZGMkRrMTEzYUdsUnY0ajE0UmJRSnBxSlpaaUJmdFNwV1lnUCs4?=
 =?utf-8?B?azJtekF5STJtNnJzN1h1amwzOU1UQkdtNzNjcXBaRHhiK2Y1dERsYmo1VWdw?=
 =?utf-8?B?WVpSVTNIaXdTSHBVODlRU2oremNnQVF3RTFzVEFxTzgrdnd5ZU45anFtQnFD?=
 =?utf-8?B?OFRTR3d6NWhZRkdlS0Zja3JVT1J0aExEejRHMy9KYmpIVFdMS0xsQzdhSHY5?=
 =?utf-8?B?MldyOCt1RS9uL3hqUTRZYmRzdWZ5K29BV0VkSTJNa2I0Qk5TN251d2o3U203?=
 =?utf-8?B?YThrbjgyTDFycGVQT2U3a21sL0ROeXZ3UXpCUWRTd3lmUldVN2g0QlJibEVt?=
 =?utf-8?B?ZmRyKzVDam1jdGhRaldDOFRFYUswekNmQ2hpbE50Z1M2WWJHdS91d1V3bjZ3?=
 =?utf-8?B?am5pc1NRT3N3RnpVOWdQeDJGYTVIcmFXZTRaY1FWa1NRZTFvRlZ2UXBFeit2?=
 =?utf-8?B?WDc5ME05REVJYS9GUDlCeS9UZElZUVhmTkZGTFpqdnk2UGZabnA0aXUvSFRr?=
 =?utf-8?B?ZHc9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?utf-8?B?U3NVR2cxcm84eEdmSWFLV25WM1hrU3IvZTlsdVNPVjdtdnFHcjM5R2s5bzN4?=
 =?utf-8?B?bkw5NW1iK1ErbWZRMkVQelZOaUFoM0ZQZXZtRzlUdW1ydHdhSkk2WGhnL2xa?=
 =?utf-8?B?WnBBZGJrelkwUHVoVWxldmJ3NHRkSTZZZ3lGK0w0WGk5bzAxek1sSlhmL3o0?=
 =?utf-8?B?YTFwb2FHWm1OOFczMmVjcEhOMGV2OVlmTXJNNlhpamRPOWZBUUFGRnNyaHdP?=
 =?utf-8?B?c3Z3QTNUMFBJNWo3UnBzZW9QZWI3WUNjZHY2cE1UWW5pUlRCSDFtZzBwT2ZW?=
 =?utf-8?B?RlJZSktMRitCUktSelNiZWZzcTB3OEFSem5xbUlDSldhNS9xbHlDSmlwdjMv?=
 =?utf-8?B?dmhIL3pzVzBTdU9LSnpCZGVBZGRwRW93VGRGbUgwdy9Qbm4wclZSa1l0RnNm?=
 =?utf-8?B?WG0zUENDSm5DNDZLbTJsN0ZZYnMvRkthY1hPOXIwYVFqUVIxZDZ1OVcrVk1v?=
 =?utf-8?B?Y09zRStlL0xxM014SnFnOFVsWVhyajgyRlU3ay93RnBlTG1kRHhmS2hCWFNC?=
 =?utf-8?B?c0drMVVGYTI0TVVkdEVIcmdUVUdZbThLQW9OeHk1UHF3V0FuYlBMMXlnR2Jh?=
 =?utf-8?B?YTVUaGpJcEIycW5CMmt2a1R3RnU1a1RrVmE0U0tHUm1TTzBkeGdxWWVjZzds?=
 =?utf-8?B?ak9PYjAvUjlJNXNQZStjbWlKek5nYVpUV3l2cHNsZjlVaTBJMzNCZHB1cWlX?=
 =?utf-8?B?U3Z3SkFUSjQ0Q3JUVWlvb1h6azdHUEJscTJlUXNsYm9hKzA1N05OSTJNS2V4?=
 =?utf-8?B?VFJGSFA1djJQTFBwQm9iRE5TT2QrSEZHckZkNkJjL1RING9BVTIyV3V4RGFa?=
 =?utf-8?B?RmZpYkhRcmIvY3IzSWlndEhvVjFqTEZZazB2QmVRRVNNUEZNbnFXbG5YVzlL?=
 =?utf-8?B?TS93UmVPSjgzZU9mUzhkZ2pJN0h5N1dDVFo3VjF0NGk1UkM3aGwyN1F1dlBq?=
 =?utf-8?B?dkJ5UFRya3EvYktaeVNzS2hDMXI5cGVMQ3JUdnpVYTdPL1dSREdLQnJVTDY0?=
 =?utf-8?B?TlBpU3htWW92dnRHbnNEZWNzdnI3UWdYUGp1VkxUTjhLbHFOWGw1UjkwUDNL?=
 =?utf-8?B?NTg1Ny8rRlY1U0JPWVVyUFJDbGpPZGhMOExXU2g2YUJUanNaeGYrQTBIVTEw?=
 =?utf-8?B?aUEydFpxVkVUMXZDcEVram5ZaGFMMWFxcHFpWDd4SUVwTXlmVE1QS0J5Z0ZC?=
 =?utf-8?B?Y3R2QjFJbVBLQWY2OEd2bEE5Z3l3Z2NwMkdtcW5RWTNyWFQzUk5lZk9vckhv?=
 =?utf-8?B?MGRPNFlsU3pld2pmcXNKdUtaeWtSVVNHRVRRdGxYcnNwSTIrWVJhb2hMcndS?=
 =?utf-8?Q?WnHPE6jP1NyzWJQKDW+sSqm6oO/ujEdCVt?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 73836d4e-7552-49ff-1f20-08db71b5ec31
X-MS-Exchange-CrossTenant-AuthSource: MW5PR10MB5738.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jun 2023 17:43:57.0381
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: CtRVxSD4W4g2FxlououqiLFggUyiJHwfA2h44Tt6+zYmPdRi5Qt0agVHd7DQwcMwZ+DvJR769ADivrmNOY5vt+qUxs97mZAtSf907aw/IPw=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB7027
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.591,FMLib:17.11.176.26
 definitions=2023-06-20_13,2023-06-16_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 bulkscore=0 suspectscore=0
 adultscore=0 mlxscore=0 mlxlogscore=999 malwarescore=0 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2305260000
 definitions=main-2306200160
X-Proofpoint-GUID: CaI-Fo5OFcYkO74c_wLNQNJY6yuUfIPh
X-Proofpoint-ORIG-GUID: CaI-Fo5OFcYkO74c_wLNQNJY6yuUfIPh
X-Spam-Status: No, score=-2.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 6/20/23 11:47AM, Siddh Raman Pant wrote:
> In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block
> number inside dbFree(). db_l2nbperpage, which is the log2 number of
> blocks per page, is passed as an argument to BLKTODMAP which uses it
> for shifting.
> 
> Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is
> too big. This happens because the large value is set without any
> validation in dbMount() at line 181.
> 
> Thus, make sure that db_l2nbperpage is correct while mounting.
> 
> Max number of blocks per page = Page size / Min block size
> => log2(Max num_block per page) = log2(Page size / Min block size)
> 				= log2(Page size) - log2(Min block size)
> 
> => Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE

Thanks. Applied to jfs-next.

> 
> Reported-and-tested-by: syzbot+d2cd27dcf8e04b232eb2@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?id=2a70a453331db32ed491f5cbb07e81bf2d225715
> Cc: stable@vger.kernel.org
> Suggested-by: Dave Kleikamp <dave.kleikamp@oracle.com>
> Signed-off-by: Siddh Raman Pant <code@siddh.me>
> ---
> Changes in v3:
> - Fix typo in commit message (number of pages -> number of blocks per page).
> 
> Changes in v2:
> - Fix upper bound as pointed out in v1 by Shaggy.
> - Add an explanation for the same in commit message for completeness.
> 
>   fs/jfs/jfs_dmap.c   | 6 ++++++
>   fs/jfs/jfs_filsys.h | 2 ++
>   2 files changed, 8 insertions(+)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index a3eb1e826947..da6a2bc6bf02 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -178,7 +178,13 @@ int dbMount(struct inode *ipbmap)
>   	dbmp_le = (struct dbmap_disk *) mp->data;
>   	bmp->db_mapsize = le64_to_cpu(dbmp_le->dn_mapsize);
>   	bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree);
> +
>   	bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage);
> +	if (bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE) {
> +		err = -EINVAL;
> +		goto err_release_metapage;
> +	}
> +
>   	bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
>   	if (!bmp->db_numag) {
>   		err = -EINVAL;
> diff --git a/fs/jfs/jfs_filsys.h b/fs/jfs/jfs_filsys.h
> index b5d702df7111..33ef13a0b110 100644
> --- a/fs/jfs/jfs_filsys.h
> +++ b/fs/jfs/jfs_filsys.h
> @@ -122,7 +122,9 @@
>   #define NUM_INODE_PER_IAG	INOSPERIAG
>   
>   #define MINBLOCKSIZE		512
> +#define L2MINBLOCKSIZE		9
>   #define MAXBLOCKSIZE		4096
> +#define L2MAXBLOCKSIZE		12
>   #define	MAXFILESIZE		((s64)1 << 52)
>   
>   #define JFS_LINK_MAX		0xffffffff