Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) client-ip=23.128.96.35;
Message-ID: <423182d1-3d75-4a73-9011-da24658a40cc@oracle.com>
Date:   Tue, 3 Oct 2023 14:16:11 -0500
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] jfs : fs array-index-out-of-bounds in txCommit
Content-Language: en-US
To:     Manas Ghandat <ghandatmanas@gmail.com>, shaggy@kernel.org
Cc:     linux-kernel@vger.kernel.org, jfs-discussion@lists.sourceforge.net,
        Linux-kernel-mentees@lists.linuxfoundation.org,
        syzbot+0558d19c373e44da3c18@syzkaller.appspotmail.com
References: <20230919155542.4354-1-ghandatmanas@gmail.com>
From:   Dave Kleikamp <dave.kleikamp@oracle.com>
In-Reply-To: <20230919155542.4354-1-ghandatmanas@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?aUp6NGR3NHU5ZEg1YnlWa1c5SGZTQ3N1MEtsWVJOaTloUUdHYTJVbFpITFB6?=
 =?utf-8?B?MU9KeC9xNEZhNGUvdmFSTEpYYkVGZ25rMDl5OTJVeUtaSkttdjVUaGRPWUNk?=
 =?utf-8?B?clgzMzVvSVZscjVTNFpiZXk3Z3BZa0d0djdkY3lsUnhtSjdpaUx0Ri83Mklv?=
 =?utf-8?B?QnFwUjhneU5wZzhXc0duMFFLWkcxd3JKUWxUcmtNaTdzZG1NdTIzMjZxc25o?=
 =?utf-8?B?UzRSOGE5d0pPWXhLYWU2WGY3a1l5MVY0NmwrWHVqK1NKZVF1RHlyNXJRSVMx?=
 =?utf-8?B?dElZb29jNlV6dldNZUN1TXRGbWhkK2JtU0R1MTlUS2JVeTdOdUQrT1J1Y0Zh?=
 =?utf-8?B?MXFxcDNxZWJWTTFMYURNNi95bjJjVVZYWWJYdEExeXp6Mlo4Y3kvS0xKcURk?=
 =?utf-8?B?STByQTdJSmlRc2VPMWZrRE1uR2s0M1J0MkxaSXdFaFVNMWY3RmIvMVdySW1w?=
 =?utf-8?B?L1R4NEVSNWZ5WmJSTGpEUVE3Zmg4NlhLYTRnTFJ6RjJKU1V4OVZHaVZWeFBa?=
 =?utf-8?B?M0ZidGZBSEFCWExBbWhXRG50THAzQnV4VUEvQ0RYRlU1YS9XMnBtSzFDT2pS?=
 =?utf-8?B?RVlTSmhuVXFvTGM0UDdXTHN3Z01CWTNqRjh0cXFzRCt5M0YyUThnMHMvOGJU?=
 =?utf-8?B?NU1SNEZqNk0vbEdsN3pIZCtNeU1PTW5uTzI3VG9ZYjhqWmFsamVqOTBnemwy?=
 =?utf-8?B?Vk84dzRBOU0vZ0hJNi9uL2NSUDArQkh6Q1kyWURCYTc2STJSbERDR0lnRGxK?=
 =?utf-8?B?aURlQVZhb2ZSdEJZVFV1aXJ3TUZwZyt3RGFQa0UzWElVcjBwWUwzWFRWbWtI?=
 =?utf-8?B?S2xrV3lCNE5lOCtzaWlXdzBLZTZJVUQvWDNjbG90dkVXWnhRRDhsSi9nNXNs?=
 =?utf-8?B?aEx5MnpaQjYvRTN4Ujd3VWZXTk9tYjF3enlsZkdQRi91ckg4cjhyU25Xc2Ur?=
 =?utf-8?B?YnpxZDlKTE8zQWhFeGlMaTUrTnRaMWozdmVBZVV1L3lkY0ZFQ3g5ZG54QzFu?=
 =?utf-8?B?d2ZWUDd3WnA5VFB3d0N3NGc4VS9CRDdtcnlCVmFiMHVhYXFkVGlCYW1URWRs?=
 =?utf-8?B?TGtPUTcrTE1LUVFYeklIRjc4VDBuSVEvNm50bjhwR2tobGdHZEZmK3NCVTlv?=
 =?utf-8?B?SzR0eEZoU29XUXJFOUdQSkUzYXpBQ3AySWlZRTM5WXVQaWpGTTljd0lXL2Uz?=
 =?utf-8?B?b1dsRVFqT0M4dDZaTDRYMVg0NXJYQ0w3TitGTytJMzlYcW5yeE44SGQzdSs3?=
 =?utf-8?B?Ymtjb0hyTGs3NXpjZU8remptUWRPZ0FNY0tjTXhxM2EzU2E1dDdGNkVuSkl1?=
 =?utf-8?B?dTR1alAzbk1ydG1hSlErOUpkSU50YTBZYmo1dm5vQlRuOGpPYXdMTGJBK0xF?=
 =?utf-8?B?TmlERGhOTWlDOUxsM0M3SWNEeU1oV1djQlJhRHZtdDFHSHBPRGdPZTJhRHVl?=
 =?utf-8?B?SWczWTZrVFRWWEdVcVM0NHBIdXhYY293cnpnZSs3WFVHTEVycFVWQzlrdWJK?=
 =?utf-8?B?TW5nNktXQWprWlk4ZDN5VzdJcXZ2YTk4UVBvS01Bb0MzY25yVko3U0wxTC8z?=
 =?utf-8?B?NVJtT3YwVFZSZFlzRkJWRnM3WVlMOWRXWDdPOWFsMWd4Z0FKU2J4OW50SnBG?=
 =?utf-8?B?ODl6QkU0ZXNRczYreDV5STdDMXJWNE4vUk1KVjlmVVpQNmpBaEhsMnFnbWlw?=
 =?utf-8?B?TThMbHVueXdWQlRRYXNNM2s4WU9pZTNpK2lXMTRLWG16Zis0YWxvd0U3RzBn?=
 =?utf-8?B?d2U5RzFBc0x1alQ0dVFnVDE2K004R1FpQVVYcGhabjdFS2dFN2lKamxWRHpH?=
 =?utf-8?B?UkRhRkgwazZOVzlnL1lwVXNqNFFpT1hSdWJYN29xNFlPV3lIR1psb1MrOTBv?=
 =?utf-8?B?dFhlTVlIK3p6Q0szSFNXL3RjVjRUWW5HMCtoaFc5MWNuUVVham9NWUNIeUlR?=
 =?utf-8?B?Uy9Pa2w4MFAxa0tEdEZLdktqUko4ZWp0RkdGbGxKOG5lcVg3aUplcWwyTS9y?=
 =?utf-8?B?ZmZiTWh3R2tRZGo4Zi9ndGZGU1lCV1hkRTFqZEgvS2R0c0hKRjRjVUx3MzQ4?=
 =?utf-8?B?ZkFJTFJKVndYeVV0UTRvdTMvKzlUcTF2MUJFU0hnTnhxbGVkK2d2bXY0RERV?=
 =?utf-8?B?ZXFEb2dVODhUZVF3UERpTnN5SjNVQk9hSzR6eGljNnZ2M2VnQkZhSEtVc2ty?=
 =?utf-8?B?Z1E9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?utf-8?B?Y0huSDIwQS9NLzlYU01ycVh6b0RPTzFTVDROeC9CbnRpUFpKVjFIaTRLOURQ?=
 =?utf-8?B?ekd5MDQ5SlEyd2tOeHlLbkphcWFyM2tzUlhsczdTdHZOV1FJZ21ZTWFINzdx?=
 =?utf-8?B?ZUNwV3JxOWxVLytMYkVJUURmdHJKTHlHc3h4ZTQxcFZEN1JtNFoweG02Mjha?=
 =?utf-8?B?WklTOGJjL0hWeHlpS0JBei9Yb3J5Y05rZktZdWxubmhiaklVSC85dmJ0WDFZ?=
 =?utf-8?B?aDJoZHppSnBML2t3VGEwNUVsOW5hT25XVTVSaWpIMlBKV1BLR0gwUXAxK011?=
 =?utf-8?B?azNVZGtZZE4ybnpYSE56ZXYxK1dranJQNWtPdFJBRFE0dzhJWUIyRUp4cVNC?=
 =?utf-8?B?THc3M0toSEVob1R2UmlicUxINWxBNlJ4cjdiWTNtRVFKbDZNMkl6SzVXQWkv?=
 =?utf-8?B?dlY5ZkZzbTVnaFRDVnhVZjd4ZTVRbHgxbFdkSXp3clp0MGhZbC85VmpjSTFW?=
 =?utf-8?B?VFRuQXBCRXFaWmV0QUZwYkIzUGI0Q3k2WEdJSDZjR0drTXhEVVpWSVpZY3pD?=
 =?utf-8?B?ZldSUTdubEdTQ2Z0anV1ZDJSNVNXcTdBN0JKVVgxQnlCM2xyMm0zS2hsVm9p?=
 =?utf-8?B?dzZvc0o5NllMQTFFWUZlZFRUWmViOW00THVtK0kyQmlFN3drSm52TE5WTWZF?=
 =?utf-8?B?cFlnWDkzZ2VuVHhTcytscDRNbG5OTWNRT2dWNDc3eTltbkh3ZWg4dHpqKzcw?=
 =?utf-8?B?eEV0cHA2YTBpSkVNU2hNSmVZdmdkTG5meFdsd0R2V3BnK25XNitLb1F0Vk4v?=
 =?utf-8?B?R3dYaFB6amViWi9Xc1ZXYTFTTHN2aUIxYVNEaDh0THUwYThIUU5uYUVkVWFV?=
 =?utf-8?B?UjVSNDl5emhXKzVjSzdTWE96SWtiMnpTUHdCYlNZcXlEMzdKNVlNYVN6cWVn?=
 =?utf-8?B?eW9JcHdSSk5jQ3BSdm83WCtEaUYzUCtVSEhLbTVGcmFRVXNYSGRTckw3VVN3?=
 =?utf-8?B?b1N6RlZacDVBV25pZFYxTHZNa3I4aU5DajBTbWNVZjNBR1RSTHpXVXE5TGhC?=
 =?utf-8?B?VHBTVGM2L3MwUktIYlU0b3l0Umh5Q0VrTnJJYXg3MGZKTkpqS1QzK2t6NTBq?=
 =?utf-8?B?KzVsL20xZWpOdXBpYUJMaS9YNmdWeXhKWTJtNHRRZXgyVkRDbXNaU2dmeUxt?=
 =?utf-8?B?bk8xZXorWFF5enlKeGpRQ0FQYUtYcHl4ZkVEV3V2bnU4UXJtOXBITzhhK0RB?=
 =?utf-8?B?SHh4QkhQT1BZcVNIWm1iZDhrek1QUlhYb0QxQy9IVzFlL2MzdzJYUy9DTTBm?=
 =?utf-8?B?REdUVW1RVnFqUFc5N0kxend3eW9JTVBCekdlTGJDNEk2dC9taEd2VXJuNzlz?=
 =?utf-8?Q?wllPhOxyv70DXhK9/S29zekObeiSHTUdOg?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: aa689654-1127-412b-5a73-08dbc4453600
X-MS-Exchange-CrossTenant-AuthSource: MW5PR10MB5738.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Oct 2023 19:16:14.2149
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: KU9N8sESTcjzTHuqPaCc7xr/VG2YCe1ZLBSV7Gnexhsv8baIJMv/sRnzxQ2zdb0Om4NR8O1pKblks44LiQq3CLLRiv2FlCbvIiVpDjDdDoM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB5632
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.267,Aquarius:18.0.980,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-10-03_16,2023-10-02_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 malwarescore=0
 adultscore=0 suspectscore=0 mlxlogscore=999 bulkscore=0 mlxscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2309180000 definitions=main-2310030143
X-Proofpoint-ORIG-GUID: zZuGbXjBg3otNF5N4QlqG3LFC69iSyFM
X-Proofpoint-GUID: zZuGbXjBg3otNF5N4QlqG3LFC69iSyFM
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no
	version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Tue, 03 Oct 2023 12:16:47 -0700 (PDT)

On 9/19/23 10:55AM, Manas Ghandat wrote:
> Currently there is no check for out of bound access for xad in the
> struct xtpage_t. Added the required check at various places for the same

This won't work for the same reason I mentioned here:
https://lore.kernel.org/lkml/36683767-ad6c-477b-8b46-f10be2ad55d2@oracle.com/

The size of the xad array can be either XTROOTMAXSLOT or XTPAGEMAXSLOT 
depending on whether it is the root, imbedded in the inode, or not. It 
is currently declared with the smaller value so we can use xtpage_t 
within the inode.

I had promised to address this, but haven't gotten to it yet. I'll try 
to carve out some time to do that.

Thanks,
Shaggy

> 
> Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
> Reported-by: syzbot+0558d19c373e44da3c18@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=0558d19c373e44da3c18
> Fixes: df0cc57e057f
> ---
>   fs/jfs/jfs_txnmgr.c | 4 ++++
>   fs/jfs/jfs_xtree.c  | 6 ++++++
>   2 files changed, 10 insertions(+)
> 
> diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
> index ce4b4760fcb1..6c6640942bed 100644
> --- a/fs/jfs/jfs_txnmgr.c
> +++ b/fs/jfs/jfs_txnmgr.c
> @@ -1722,6 +1722,10 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
>   			jfs_err("xtLog: lwm > next");
>   			goto out;
>   		}
> +		if (lwm >= XTROOTMAXSLOT) {
> +			jfs_err("xtLog: lwm out of range");
> +			goto out;
> +		}
>   		tlck->flag |= tlckUPDATEMAP;
>   		xadlock->flag = mlckALLOCXADLIST;
>   		xadlock->count = next - lwm;
> diff --git a/fs/jfs/jfs_xtree.c b/fs/jfs/jfs_xtree.c
> index 2d304cee884c..57569c52663e 100644
> --- a/fs/jfs/jfs_xtree.c
> +++ b/fs/jfs/jfs_xtree.c
> @@ -357,6 +357,9 @@ static int xtSearch(struct inode *ip, s64 xoff,	s64 *nextp,
>   		for (base = XTENTRYSTART; lim; lim >>= 1) {
>   			index = base + (lim >> 1);
>   
> +			if (index >= XTROOTMAXSLOT)
> +				goto out;
> +
>   			XT_CMP(cmp, xoff, &p->xad[index], t64);
>   			if (cmp == 0) {
>   				/*
> @@ -618,6 +621,9 @@ int xtInsert(tid_t tid,		/* transaction id */
>   		memmove(&p->xad[index + 1], &p->xad[index],
>   			(nextindex - index) * sizeof(xad_t));
>   
> +	if (index >= XTROOTMAXSLOT)
> +		goto out;
> +
>   	/* insert the new entry: mark the entry NEW */
>   	xad = &p->xad[index];
>   	XT_PUTENTRY(xad, xflag, xoff, xlen, xaddr);