Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) client-ip=23.128.96.32;
Message-ID: <5d03f98a-262e-441c-812e-8257d66680c5@oracle.com>
Date:   Tue, 3 Oct 2023 18:36:25 -0500
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] fs/jfs: Add checking for out-of-bounds index in binary
 search in xtSearch
Content-Language: en-US
To:     Juntong Deng <juntong.deng@outlook.com>, cuigaosheng1@huawei.com
Cc:     jfs-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org,
        linux-kernel-mentees@lists.linuxfoundation.org,
        syzbot+76a072c2f8a60280bd70@syzkaller.appspotmail.com
References: <VI1P193MB0752266E3E55B2D918F8E43799C4A@VI1P193MB0752.EURP193.PROD.OUTLOOK.COM>
From:   Dave Kleikamp <dave.kleikamp@oracle.com>
In-Reply-To: <VI1P193MB0752266E3E55B2D918F8E43799C4A@VI1P193MB0752.EURP193.PROD.OUTLOOK.COM>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?aW94Qi81R3pucFc3ZjErQ1Z1RU5wTVB5dFVJM1NGdjZtN01sZ2xDV29oUkFs?=
 =?utf-8?B?RFByYmRodjZlWFR0RWF2bitmRmpFa0NIVU8yaXVhSzdMaXhCNGh5UUtQRytv?=
 =?utf-8?B?bEhrQUlGc3A3OEtMY2pQRFV3MXpXd1loU25Hai9zc2xGWHVHN3lUSGMyQ21z?=
 =?utf-8?B?SW9CVnEwSTZnUkMycThlSnpZNmFhYU9UUE5ZSUkvVCtLSzgyMXg4UDBCS2Rm?=
 =?utf-8?B?aitHVk5FSlI0bTBkYU1sSnFpTncvS0tPdVhPVDRGSklra2dHNFhNMWxsa05t?=
 =?utf-8?B?L0hyMDFwQzcvOGg4N2ZDR2psNkVnalFvY1lPVzZqayszT2pvYzIzVFFoanJo?=
 =?utf-8?B?cFBrNS9RQXpET28wVDRxZGNWRjBzMG9VN1ZhV0hNOHRtallJVWVpYmVzdHRu?=
 =?utf-8?B?eG9BZndRd3F0VGtrVDZ6WFIvSWhJRWdaZ1VuWGcrZ0t3K2lLVExPOWk1WGJi?=
 =?utf-8?B?RHJ2WmlkL28rQTdKb3ZLNUtqeDBUNWZnZmw4cHR4VFVTUWwxOW4rZWQ0M2My?=
 =?utf-8?B?anN0YkUxWklkcGZaMzI0ZVV4Q0dZWVNma01kaWtOYjUwbXRyNVdGcjh1TC9L?=
 =?utf-8?B?N1BiMmlrRFhsUFYzeVRVR01iZ3hHVDBZWDBVWEUxZHlySnlQdGFkdjh2SzFq?=
 =?utf-8?B?bTN6cUxIdDJGcUhSQU9TeGRRRlpIWjVHM2MrM3Q0OFBlQlBnNGl3aTVwVEJE?=
 =?utf-8?B?N1NibVNnRllheXNhYmJ1UXhtOERuSGFaM2gwZXE1c1ZSSVlHdGQvNW8yRm5h?=
 =?utf-8?B?WUZiSUVVWFMvUTg2U0pacm5wblRhd3p4a29hdHdjNngzREdJNUN6VlpwbEZV?=
 =?utf-8?B?Y0s3MzlsY250cTc0Zjh6WXpkQlczeFFRNXNHZXBqVWxwWnZraU4rSktLWWpW?=
 =?utf-8?B?TXhvK2hxdUhCaUh2aXo2SWtTZTBVRkRPeUxNWnB1aHY5OFpCeUZmeVJHQnVV?=
 =?utf-8?B?SndPV2V0ZllUNGNBcDl0QVBnaCtFeGhLUnR4Y0J0cXU5aDh0THIyZDFxbUlD?=
 =?utf-8?B?dDRLLzhBVWpJWWY1ejRwRGZQclUxSi9DbVVZOXo0TEszVXkrOGFaRDdtNnVs?=
 =?utf-8?B?L25hLzZtRWtHdDdyYy9QOGZXUVBRczVDQk5xRjFLTmhPRlY3RnlxY0s3UlQ2?=
 =?utf-8?B?OFZob08vN3JKVTlOZzRpZ0J0S3ozMFdKWXNUTkpNcWhUVVhITEdLYm1YN2E1?=
 =?utf-8?B?TEFoMDhEQXI3NWFReGJjWE9Sck9nT1RkWDRKVzlhNnU3NUlUUGRiMTJYSTYw?=
 =?utf-8?B?cDVnT3N2YlQ2dXJaWVkyQ2lIKyt4cnpmRnhuRTlLcStTNnZXaGdkbVQwMW5q?=
 =?utf-8?B?WW9tazByc2FFVHViUCtCY1hhYTFDT29IaHJZRzd3c3o2NXNYTEFZMjlEQUto?=
 =?utf-8?B?em9Fb1ZXM2FzbmQyOGxmVVQ3MmlReWovVkdZK0k2Yk5odHlLUko4Y0dYZC9o?=
 =?utf-8?B?R2VjdGZNL09JaWZDTUNJMWYxTE9FU2s5NWZkV3RMcERxbUUvSmZFd0FMUWg3?=
 =?utf-8?B?MWdlZWdjZ2VLbUhLM0lmMVNUblFkZzdIK0NWdFBzS0ozcVEyaDlUemRMQ2xC?=
 =?utf-8?B?ZU1jSHo3WHhuMzh6UTNBVDRZNVhuQ2NVS0l4YnNFU1QxeUJKSGtxdHJ6N3c2?=
 =?utf-8?B?ZjVzaGdPbFJXOUJvdkVjU2FYOXZTWFlCL1hXUFFqQzQ0Qm91RjJXLzVseG55?=
 =?utf-8?B?Mms2TnAxdUQramRxOGdLQmVRNEFwTjBwMDBJWkpPYVlFV0N5b3YzTGhueGs1?=
 =?utf-8?B?N2U5NmZZR2x5VDJ4T05VdFdGVDI3RTB5MDdvVDE4L3ZEOUtQWm1nSUQraWFI?=
 =?utf-8?B?d0JQa1ppUVZnU2FJcUpzb1ZPN2tjT3dla3o0M01zbm91c0I1OFMyWjYxRzg1?=
 =?utf-8?B?emZzc3BTNWJHRW90bDViTmhZWE5JeXEvWUh2T0ZxMTVQNStNV3FYYnp1Q1Az?=
 =?utf-8?B?VGxha1lCc2NHR25HOCtSVjBCNDhVa05GRGJBM3hJRjZoWXNBcnI1NDNjZGgz?=
 =?utf-8?B?TlJOZExTNGNrUXJjL2NUUUxPMkZta3c1U0UrNGN2WW1DeVhYUyttOUl0QnFa?=
 =?utf-8?B?Q0hCWXQvWjI5ODNyc2tGc0daRTB1VkRTTkh3elhlSG9GTVdZWUp3WVBuVFhy?=
 =?utf-8?B?czNRcVJtdmlwU3ltQkxaUHA5UXZ2Z2JqL1Zidm41dTVtajRKRmxNTk9qMXhJ?=
 =?utf-8?B?OWc9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?utf-8?B?SjNlcE5DcnVMUTNGNUhhZ2VrWThoSHJ1YUhmVzI2UjJEUldMcStQOHJrQk9L?=
 =?utf-8?B?MUJuNVhBaEhlcVdYMUNzSEVuRDIwUlNkendkYjhXWHBlaTlNWE1tOGVsREMz?=
 =?utf-8?B?VTk3Z0NhbHh1UWZPbVBFNzhxa0J5RzB4RElNWjlYRDhvaUZxSFR6bCtkSjE3?=
 =?utf-8?B?Y2FtZjhySGpTK080YlA1Y2x5cFB1ZHMxeFJhTzVGa21wdTBhVWc2aG00QlBu?=
 =?utf-8?B?ZC9kczc1ZkF1TWVMZnlHNnhjdFJVOTB4c2J6b2JpWEVYcld6eHZOODVNa09v?=
 =?utf-8?B?NFlWZ0JCNGs5dmN0ZXZ6YkZnMEZPT3RGSWk0UGl6Z1dpT2xNWDdWZ25TNld2?=
 =?utf-8?B?SHBCUll1SVdXTFI4cjZONmJUa3RDcm1VSUJqMEpMZXp2d2JnNGtQMjRNdEcr?=
 =?utf-8?B?dDJqVVEyNnBlcWVNNjRZTytMWTlNOENLZnJ1Q2d3VVNWYm1BbllEYnUyWHUv?=
 =?utf-8?B?djRHYUErS2J1WllPRjhNTWRrbWhkVHFZSmVDSDFZcVhqU3FINloyR0NzNnFi?=
 =?utf-8?B?Qjg3ejRtR0hXQ2lSOXBVcFo1aGs3Zy95YTNOWFk3Y1ExM3ovYUwwL0xXWlY0?=
 =?utf-8?B?ZUk4TzQwZ1RLdjdLTnRFd2dBeVZXcWlLT1VOd2tqMzZpMnhobE1CTWpYaEpJ?=
 =?utf-8?B?U1RCTlJ3S2pxc2ZSTUxZZ1FuUEF2V3E3MW9kMDJzRmwvN1c4V3VyRloyaU9E?=
 =?utf-8?B?Mm1naVNlS0F4L21DNHB1bS9aNGR0cjlYRVdaekg4Z2cxcWV4UHZlVG96U0RM?=
 =?utf-8?B?VGI1ckNSZE5iZ2dPRWxIRDltSXhRRnNrTk9mM281Uk5IRDZyT2VETG1TQU9x?=
 =?utf-8?B?MDFHWVE5QkZFS0NzN1FJNFB1U29FNkJObTNkL1dCdllJVFkrOVp1WjBqM2pk?=
 =?utf-8?B?RmJFckVLeHpGdHBVMWJBVTBoSXN0VkFucG1PRFdpdzdrVjVwTEMvZW5Vdkx4?=
 =?utf-8?B?SUhvOThGU0hpd0R4eUNZd3EyZ2Jhb2NTV296a3YxREpmRk1sMXF2RisxTUNr?=
 =?utf-8?B?OUowUlNiVXlDY1diMzFuNHlQZzVib21XUVM5RzR5bUV6Q09ZOGtLampKZTlq?=
 =?utf-8?B?VytsMU0rbUVlT1I2TjBsZXpMZklyWTMrZlhkbzUvUVpmcjN6TkJHd0l3VGFF?=
 =?utf-8?B?dHR1Q29SMWdBT0NLaUtVaWZQYWozZWxob1dlS1BocDFRSXZLYkx0dHVJRmsy?=
 =?utf-8?B?NTYwMzQ0bHA4NWRPQVZpMmRFOVd4NG15a0FWSThOWGJlOE9oVld2VUtFUFU4?=
 =?utf-8?B?d3JYZjZBekxmQkxhL0Mva01WUkM1cEZkRjYxSzZJcEo2eTZXeXVGeHovWk1E?=
 =?utf-8?B?NkVSZG50bSt1RjEvUVJWZkF6Y3MyQzJCaC9IQzBENWhpdW0zSm9oa0NDSk9U?=
 =?utf-8?B?UllHZzVTMDdPckE9PQ==?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4f5a6e30-32cb-4752-9be2-08dbc4699104
X-MS-Exchange-CrossTenant-AuthSource: MW5PR10MB5738.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Oct 2023 23:36:28.8252
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: EcOoLajzcZrMgNt9Ys1DYQveoRp76OpLJTRuHco9Cu6e1Xt1wQKh2o7Pbv2J7M4SRwjaHK/7tov29oJBv8R3x9tdKf6uhhKdNqbM17WcsF0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR10MB5967
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.267,Aquarius:18.0.980,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-10-03_18,2023-10-02_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 mlxlogscore=862 mlxscore=0
 spamscore=0 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2309180000
 definitions=main-2310030179
X-Proofpoint-ORIG-GUID: 94y23-3zhyE3okwzNFc7ZGfj0xI6Ud30
X-Proofpoint-GUID: 94y23-3zhyE3okwzNFc7ZGfj0xI6Ud30
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no
	version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on agentk.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (agentk.vger.email [0.0.0.0]); Tue, 03 Oct 2023 16:37:32 -0700 (PDT)

On 10/3/23 5:49AM, Juntong Deng wrote:
> There is currently no out-of-bounds check for the index in a binary
> search, which may cause errors.
> 
> The following is related bug reported by Syzbot:
> 
> UBSAN: array-index-out-of-bounds in fs/jfs/jfs_xtree.c:360:4
> index 18 is out of range for type 'xad_t [18]'
> 
> Checking if the index exceeds the size of the xad array can solve
> this bug.

This won't work for the same reason I talk about here:
https://sourceforge.net/p/jfs/mailman/message/40826617/

The xad array can be either XTROOTMAXSLOT or XTPAGEMAXSLOT entries long 
and it is declared with the smaller number since it's included in the 
inode. I will fix the declarations so that we can use the larger number 
without triggering code checkers.

Thanks,
Shaggy

> 
> Reported-by: syzbot+76a072c2f8a60280bd70@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=76a072c2f8a60280bd70
> Signed-off-by: Juntong Deng <juntong.deng@outlook.com>
> ---
>   fs/jfs/jfs_xtree.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/fs/jfs/jfs_xtree.c b/fs/jfs/jfs_xtree.c
> index 2d304cee884c..6b55bb1e4089 100644
> --- a/fs/jfs/jfs_xtree.c
> +++ b/fs/jfs/jfs_xtree.c
> @@ -356,6 +356,8 @@ static int xtSearch(struct inode *ip, s64 xoff,	s64 *nextp,
>   		 */
>   		for (base = XTENTRYSTART; lim; lim >>= 1) {
>   			index = base + (lim >> 1);
> +			if (index >= XTROOTMAXSLOT)
> +				break;
>   
>   			XT_CMP(cmp, xoff, &p->xad[index], t64);
>   			if (cmp == 0) {