Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.36 as permitted sender) client-ip=23.128.96.36;
Message-ID: <c943f428-3759-4922-9622-fd481d0ac26d@oracle.com>
Date:   Tue, 3 Oct 2023 18:27:45 -0500
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH v2] fs/jfs: Add check for negative db_l2nbperpage
Content-Language: en-US
To:     Juntong Deng <juntong.deng@outlook.com>, shaggy@kernel.org,
        wonguk.lee1023@gmail.com, liushixin2@huawei.com,
        andrew.kanner@gmail.com, wuhoipok@gmail.com
Cc:     jfs-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org,
        linux-kernel-mentees@lists.linuxfoundation.org,
        syzbot+debee9ab7ae2b34b0307@syzkaller.appspotmail.com
References: <VI1P193MB0752E63048A98BC70E4CFA9E99C5A@VI1P193MB0752.EURP193.PROD.OUTLOOK.COM>
From:   Dave Kleikamp <dave.kleikamp@oracle.com>
In-Reply-To: <VI1P193MB0752E63048A98BC70E4CFA9E99C5A@VI1P193MB0752.EURP193.PROD.OUTLOOK.COM>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?NXBkMjRoUDRPVW8yQVFTZzRxZWMvcVhNcnZnQ0IrR0F2TVZqdUw2NXFiV0ky?=
 =?utf-8?B?aDB4d3FGc29TaHFIZGFVSW1yb0F0ME5OQ1czQzAyYm9kcWJ1T1JEU0l3UzJC?=
 =?utf-8?B?NkcrNUEwTFA1MTN1RkkwY2xoNkh3aDhGZ3lRUlZjY09IRXVnRXkrRG9FamM5?=
 =?utf-8?B?ejBoTDZTeURZMElEL045Yll0S1RaeVczSkRtbVpncnNPTFY1aWdmR0FsNUxZ?=
 =?utf-8?B?Z0MxaVNscVY3dHF4WDNFRElHS2VyQStBUWdiMnR4cTBYZlNla2tTTTg0RGFP?=
 =?utf-8?B?aGpOWG1yUm1wRmdRWUF2aEd1R2s2TXNZcW1WRGk3T2ZyTVE0VitoTUhmekJJ?=
 =?utf-8?B?WjdiQ3NURk1KVHR6dUhFQ0R6dTdCSWRUcVNHR1EvS1JFdVk4dGNNZmxDZ3hj?=
 =?utf-8?B?Uzd0clFtQXdiamhjMWpRenBPdmp1dkY5cWJORS9qTHFkNHpONEM4bHNsRmpl?=
 =?utf-8?B?NFFDTVdOdXJkVUN4VUM0ODZwTFhpMEs4UHVabEF6VFpVcHBzRUFGOWwwbytk?=
 =?utf-8?B?TUdvRElmbTJxdjFITDFPS3dUWjJidTFKWFRUY1NaUUxKNklXTFROWDlzVk5M?=
 =?utf-8?B?cVhCME5MOEN3SjFsWGNjSnNXY2VlNE5ISENVaUZFYThzcmJsS3dPMEpHMkx0?=
 =?utf-8?B?bG5RYnRDV0xiajNNSzFPb0hMUFM1Z3FURjVvaUpoNW4xc01XdnUrTGsybDNY?=
 =?utf-8?B?ZVZKTFVKNDFjSUx4WmNES2dNRGliV3Q3ZHBtOU9zWWVTSW53QWlGVTY5ckha?=
 =?utf-8?B?QW1QTTNqbHRKeVB2YU9YdHZxV3ZRdW80ekxXeHpZQWc5MDFtWi9lTGZyUFd6?=
 =?utf-8?B?NWNyTjZ5a2ZTV0VoZkl3S3pnZm8zZktiSVo1VHNYcTBmc1ZnMWdDYTFkaVd2?=
 =?utf-8?B?d0xreHg1eXovZ0hNdW45d0xVL2FVQVhiUzVaaUd2azkva2xLZTI0R2ZXNHR4?=
 =?utf-8?B?ekdLTk4xN0I2c3BlcE4xNXViZFRRdEEzU3BBbnhWUHFzQmsra2M5bXQyeEJB?=
 =?utf-8?B?ZnB1MnJlK0l1T1YycWRxWnJVcmU4WE5CdmJoUEoySjhvRGtVK21Ob0E1M1Nm?=
 =?utf-8?B?K3E3WkpoWkkxUm82YXg2akxsR3ZWRkt4V2dpQWtTMThnd0FucU9JdDNQZUMr?=
 =?utf-8?B?WjF5bXVwMGJzem9ncVFPREgyYmdnR1hPWmZYejRXL1NBM2dIR3B6emg3QXpJ?=
 =?utf-8?B?a3VxTndzZ2VtMHFaSUkwLzZXaFNjWU05R0JWY3Roc0tBMGt5UUdBZFVzbTBH?=
 =?utf-8?B?SlZnbityTWVjb3AyZGFVcXdiRHZrMG1mc3ZMMkZ6bTFFTHU1SlRsT0J3T0ox?=
 =?utf-8?B?Zmk4aEllVnRBWDF6OTQzN3pzVnJRN0VML01vOWhiY0NHWHdLVUtiOHlBMHFF?=
 =?utf-8?B?WmJERVVGSGtOb0lOemo3MXhxUGE3cHpmandTOFBvMloxVUVZUmdZS1IzTkFs?=
 =?utf-8?B?Y1B2dnlsUFlzTkV2U083YnNUS3NsbmZIa25zMWxRTU5CbEhyUEh3N3d3M3kv?=
 =?utf-8?B?UjNNMnVpajA4S3hlbFpxdnVYTVl2cnhaNlJOMjRRK3lpSkJBVjVYYWJ2V21J?=
 =?utf-8?B?WVZSWTlQRE15aHJma1Eyayt4YmRBcXNubDNpVUwxOFNmZE5tcUkyMWtGSGx0?=
 =?utf-8?B?MVRVempLZ0lRNGdLRFNpQTNXbnNBNVgwRkdUSWJDdzVoZ1NVdmRLV3BEb0lj?=
 =?utf-8?B?c09EQ0NCMkh5OGtqUVcwUURrTkdOd2ZJaDBGQkRmNG1vYzFXSlRUM1g4WWRt?=
 =?utf-8?B?dDlWTE1oMlcyYW04cUlYT3Q4a1RVL3p2NGdGcko1VUE5b3prRXpibjE0Rmhv?=
 =?utf-8?B?RGZFSFZCVmxSMHBoc08zN2tjai9vc2xERXZjWmEzeks5d1FoVDdYSllzMktQ?=
 =?utf-8?B?ZXE1YklDeEY5V3FNeTJLN292NjRSYmhxSFJOMFpBMVJXbndVVE1Xb291YXV4?=
 =?utf-8?B?OHZVeXJ6U2FpNkp6VGF5Q3pETHEzWjYwdHU5MXd3TWVJSWEyVnFqZS9pNVds?=
 =?utf-8?B?bkxtdFYya25DYktCWDNDK0lwZWE2UWQzV1FnZW9NOE12ZmMyZTNQV2JPTXk3?=
 =?utf-8?B?V3N4OWZuTTJMclFJVkhvSlhqNnVpRHRrWndiZmRHb2ZBc0szQzFqZ05sTWxB?=
 =?utf-8?B?bVRBYnV5T2p1SDBxWUdNSjR1NURnQ29ralh0ZTdPVW9MMkEyKzZaTGlSUURl?=
 =?utf-8?B?V0E9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?utf-8?B?NFdoYTFsb2xSam5pTlpYMmFwejBGV1FXNjBZSVdxeWU1alMvcERHVzJtWExo?=
 =?utf-8?B?U2paY042bHJpNVE2cC8xR2dUYlJ5UmVrbDY3c0ZxVXV3TWhSeDkvVnNxOVNC?=
 =?utf-8?B?V3E0Y1huWjZ1d1ZQcjhkMzZsMXJVTGJIMFZLU0tXNlpKeHBMNEhpVkZpRGh2?=
 =?utf-8?B?dnRXNVFnKytubDNIT3JNeHBocjVaN2dmaitNeGtiV1JneGdqTnhsVVc4RjIy?=
 =?utf-8?B?cTJ5WStCTW9KU3I2d09yUTFINXh1OUJqdWNIN2VUQmZqTTJIYjIyamEvcTJy?=
 =?utf-8?B?cXh5MGJ2ZkFpNHFZdXhzMlJhSEVibDFzUnhwMTd3d2I0ODgvcTIyRFREY2oy?=
 =?utf-8?B?OC9iam1FZVc3OU9Xai84R09zc0pBODhFcUtlcmRWMGdTcjAreksyckR6OEhT?=
 =?utf-8?B?NUZUUnMvZCs3cWJWajZsZXR4ZDdCakVTYkVMeHdZb3VVeU5PWGxBMENDUjkr?=
 =?utf-8?B?czJ6K0pSZzBWSUdMdCt5TElENGdZL2JpT0NOVWNzVThtY3BBSWh2NjU5aGFi?=
 =?utf-8?B?MCtRNDRONHEydzFNdU1DeUpoVHgzZm9QQ0FpWEdPeEExa3hzNW43ZWhyZys0?=
 =?utf-8?B?MEFnMTB2QTQ2cS9yM0RNd1RaaFBZTEFpSlJVbWZwTjJUQzNGZ0IrdzBsT0V5?=
 =?utf-8?B?bGY0aE8vbWxEb1hxZnAxYzBRQk5GTElRZTBYZlVTZWdsUXcyRm9zY3NraXE1?=
 =?utf-8?B?a3BtVlFDNEhGT2l5NllFZDd5N1JEeEI5UGdFazh3ckVHTUtkaGNMVHZSRVE4?=
 =?utf-8?B?SFI3M2ludmFYVlptYWV4ZHFyN0grblBBeHI5Mi9wd3VHelFpa3BWTXlvZ3Fk?=
 =?utf-8?B?MnJYanlrbVBZejBPWDBjTm0ydngxKzIzSHB6VHF1MXBpQkJWNitQWmFTeFZX?=
 =?utf-8?B?UHk4SVUrSk56RjFKQy9FaWh4YWhVdC9wUzJBblRDdFY4K1U5d3lOZ3k0T3cy?=
 =?utf-8?B?Nk1vT1l4VEtzem1UQVdtc0d6WWs5cTd6cXgyNGp4bnAxOTJUVE5YUzhqQ283?=
 =?utf-8?B?cTJjejdPQXJzaXlRTThERVVsdFFGTmdocVptWU5iZjdNc1ZSaGFZSTVqNWpm?=
 =?utf-8?B?T1BIdnhxVjZkNWNHTWtuQXFBR2x4YW0yRFZ3Mk5KM0dwazlNM0hZenN2bVVl?=
 =?utf-8?B?YnhKM28xa1FJbG1weW85REE3NFduWWcydjJIS2RSSTZ6T2lGSGVXM0RYUUVt?=
 =?utf-8?B?MDF2Z25BNGxOYXhrK055T2V2czBqa0t0aVpKem8xcmpXWmpuTmVUdjR0d25z?=
 =?utf-8?B?d243T2ZyaSsxRzFLSFpQOXJOSFlDR1lvclRnUTlRMndoSm1ZWDByZXNHMng3?=
 =?utf-8?B?bE9qMkcwcktJMUNvQUd1bTFONzFWR0QxRWl4UTJGV3pYbzhZTTQ5Wm5TZXJq?=
 =?utf-8?B?eTZzRnh6QWVjbFEwWktXaGt6T1J1cEtvWEl4V3ZYcG1rQWZnWHozNGorejdV?=
 =?utf-8?B?RWpHWHdMcnkrZWFyV3BMRnBueGtRNVRBYWFyUlh3PT0=?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 30aa0038-bafd-4203-f304-08dbc4685a45
X-MS-Exchange-CrossTenant-AuthSource: MW5PR10MB5738.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Oct 2023 23:27:47.4547
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 3WTQ5k1qQdF+y+T6KuWN6/gBMHH8eC7UJjyhCwFWAom4xoyphMkHAbIjLfREnkBCuUXEwpKLYNNN6KmmWG1G9AQ/AGnsYCAhyUx5lbz1J9M=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN4PR10MB5654
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.267,Aquarius:18.0.980,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-10-03_18,2023-10-02_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 malwarescore=0
 adultscore=0 suspectscore=0 mlxlogscore=870 bulkscore=0 mlxscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2309180000 definitions=main-2310030178
X-Proofpoint-GUID: nwT1frCOkzPADS2215ZrynbEUogwyomC
X-Proofpoint-ORIG-GUID: nwT1frCOkzPADS2215ZrynbEUogwyomC
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no
	version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on pete.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (pete.vger.email [0.0.0.0]); Tue, 03 Oct 2023 16:28:31 -0700 (PDT)

On 10/2/23 4:56AM, Juntong Deng wrote:
> l2nbperpage is log2(number of blks per page), and the minimum legal
> value should be 0, not negative.
> 
> In the case of l2nbperpage being negative, an error will occur
> when subsequently used as shift exponent.
> 
> Syzbot reported this bug:
> 
> UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:799:12
> shift exponent -16777216 is negative

Looks good. (A little part of me wants to go through the code and make a 
lot of signed ints unsigned, but not today.)

Applied to jfs-next

Thanks,
Shaggy

> 
> Reported-by: syzbot+debee9ab7ae2b34b0307@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=debee9ab7ae2b34b0307
> Signed-off-by: Juntong Deng <juntong.deng@outlook.com>
> ---
>   fs/jfs/jfs_dmap.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index 88afd108c2dd..3a1842348112 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -180,7 +180,8 @@ int dbMount(struct inode *ipbmap)
>   	bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree);
>   
>   	bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage);
> -	if (bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE) {
> +	if (bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE ||
> +		bmp->db_l2nbperpage < 0) {
>   		err = -EINVAL;
>   		goto err_release_metapage;
>   	}