Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.34 as permitted sender) client-ip=23.128.96.34;
Message-ID: <86037633-6741-44bc-87a9-171d7021171d@oracle.com>
Date:   Wed, 4 Oct 2023 09:22:42 -0500
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH v3] jfs: fix array-index-out-of-bounds in dbFindLeaf
Content-Language: en-US
To:     Manas Ghandat <ghandatmanas@gmail.com>
Cc:     Linux-kernel-mentees@lists.linuxfoundation.org,
        jfs-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org,
        syzbot+aea1ad91e854d0a83e04@syzkaller.appspotmail.com
References: <20231004054718.7976-1-ghandatmanas@gmail.com>
From:   Dave Kleikamp <dave.kleikamp@oracle.com>
In-Reply-To: <20231004054718.7976-1-ghandatmanas@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?R2s3eGZ3M1pCSmpOd3YwUzZJN3Zqd0c5akFYc20yakR2MHZNV2xISUhVbzJl?=
 =?utf-8?B?SytlWHNNWXF5cjdJZGVwUFRYNkM2V2hSTlAxUlpCdTMyaHU0U3A2ZFdCenVU?=
 =?utf-8?B?a2JaWGxEcHFOeEVuN3Z5WTZRRkxSdXptVTBpTDVFSll4WmdmUWFyaGxNWXA5?=
 =?utf-8?B?YWZ4MDZTMG4rdlI5cTdEZ24ra3FXZmV4TW1TbGJ5VXlqaWVheEtRdHFBSlVa?=
 =?utf-8?B?WjVuUzBIMkRLY01GNFBWdnVvSmtheGFWNVgyaE9IMmV0anl2MmlncUVSeVRk?=
 =?utf-8?B?WWl1UkxPTGdqSVRkMlA1Njh5dHJMYjZjT0xMZitVbzcyYlU1cXpZaVpGMXNM?=
 =?utf-8?B?NWp3SXdhK1QwK2pPbTZMSXpoMlVKQXJwOUpaZzl2TlhncVl4U3U5Tmh3anVO?=
 =?utf-8?B?eFp5MDhHd1dCYlNRcldYTktPc3R3RlVvSS81RGpCUUduaTJwK2ZIUDgwSnhD?=
 =?utf-8?B?ZVUva2xtckd4bTNRYkNrbGwrVG5OWjhiU0dET21KcDFBQWdaZ1dIT256c00r?=
 =?utf-8?B?alg4UHR3WXlGeDc3aHZiMU9wWVBqeGZFV3NRNmlLVHAyRy9Wamt5ZTQzTG1S?=
 =?utf-8?B?d1VoSkszcGZYVkQ4eVVDekdvTlZZbmIrdktvS0VmVXpqcDI3ejZpWHhldWF5?=
 =?utf-8?B?VEhUTzB2eEZVakFvak1lWUJRV0xPRG1kL2ZIclNlSUFodUFuSDc2c0pxOW9O?=
 =?utf-8?B?WVh0czM2TE1zYlI5M3ViS2pieGZQZmZwWWZnald0ejQzbUxnOVZ0MDVYcWtk?=
 =?utf-8?B?bm5GVjcxNC9MS1Jzdm5UN3dvWFd5NG82NTcyTWJ2OFRYc09pWVZydGhVblp3?=
 =?utf-8?B?TXdxWUlTcEl6WWJLaSs5MTFNMmNjUldrdjROdnN3M0wrNmhXbTE0cnUxOTg1?=
 =?utf-8?B?VVk1V3FLWUJrb1daaE1icy83K3Y3aHgweHJBeFBOVTFMWG9raDZMME9wSGVR?=
 =?utf-8?B?bXoreW5nMEtjRkZZQTI4WjJFcWR2eVEvT29sSHhsVDZvZWo3SldCcUEvSy9B?=
 =?utf-8?B?dlRiMHV2TEVrWERJSHRVQ3NIdzZsMkg1K2NydklWZFF3QWlMUHJXaW9oNkNn?=
 =?utf-8?B?azdwYXNINEJXZmlFNTVRK2c1Q0R2VmNaSnk5WXM0VUN2dWRnUWhvaHlWTEk2?=
 =?utf-8?B?WWRVU2c4eWh5bjNCYWphZG1GWmY1YWo3dUYzV2oraGZaR3lJeGxjSkpmV2lW?=
 =?utf-8?B?Z2tITUp1YklRQjRpblBkcGh4Vmd4dVUzaUo1clA0V0g2SERuWUZwc1N1UTBM?=
 =?utf-8?B?MTRHa1g4cHdROU1nU3JwRGdBVmgrc253TVBuODh4bVBDaG15Ry9Rbk5vSFJK?=
 =?utf-8?B?R2N1b1FmbWtvanc2TlE0cjlHbW9WYmhzWWpBczNidjF0STNaY3F4WG5WMGpK?=
 =?utf-8?B?VXVFbGR0Nyt4WlRuMGZleVhYSTNJekU1Z29KQ0lYZll3ak9CN3BwNGpBQjln?=
 =?utf-8?B?ak8xVmwzVGdoTkpkOExNSFpIOENabm93YUU4eW5xQzN4QUhaUVZXNHdyUS9W?=
 =?utf-8?B?TmxobHdRM0RVYUQyTWJtUWd4SGtORVg2VnY3bjVZNjZiM2NSbTFBeitWVXZr?=
 =?utf-8?B?OHNjRXE2TnNOcFdoN3ZnWkdQTzBWazY4aTVmVllteVpBSUE1MGhTbVVoYmds?=
 =?utf-8?B?SXNDbnVoOWo5T2FsUlFwbDQ3dFRydWcwQjVFcjBVRnpjRjh0Kzh1UmtQZkVR?=
 =?utf-8?B?R3FEaTg4elY1VUxRMnZaU1RSSExZYytzV3JHTmZYWWZzOEJwblFYMHlPUkVL?=
 =?utf-8?B?TmJvK0E4N2M3SFBqQkNCb01HZTR2eVVEREE2U0RsSHlWbVNZUExWSVBlbm9C?=
 =?utf-8?B?akRwdTA2eCs2emxITGdIZmpSS01mQmlWWjIwRDhyVGFuWlZsUDEvWUdHOE5j?=
 =?utf-8?B?YmxLWVpxYkMyRVNYdU12SGFRL1FHVDd2Q1FBTzJKMW5zbTlZNGdkOE55ZnpJ?=
 =?utf-8?B?K05qcGNzakxQam9KMTJxNUVSay9mTDEvTDdXVmhCak12T01tcklKclFqQzVC?=
 =?utf-8?B?WFlERElSdWNERzBPWXBoTkluelN5c0U1REVHQ0g0R29LQ21IL3RBemRVeXJN?=
 =?utf-8?B?dzIyWnVzNk8wdkpuK0thSEJWWEFPcW40UzVWTVF2eHVhMHhRR3cybzIzZENs?=
 =?utf-8?B?dXpjVW9PQTZFeG5rVkJkTUxHNmZLL01GL3NEYU0yaTF3WE1kMDd1QTZyRTQ0?=
 =?utf-8?B?WUE9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?utf-8?B?V1gxMlVudXFVdmxlUmU5UXBCMmd0ZlBPY25QQjMrVFJzdDhHYUxBNHB1MmNS?=
 =?utf-8?B?S0Y5czlRSVVaVDFVK0xIdWpkMTR2aU16U0VBUk1JQW9qUHlOQk1CdWIrVVND?=
 =?utf-8?B?WUl2ZmY4L3ozNm11d1dyNndvQk1uNjh3cGY3MDRvcVpqTUpieEZzc3FqZ1dM?=
 =?utf-8?B?Zyt5T0szakVSSCtxT3VQR2lmSG8yTjNyem1GU0FLMDdGM0IvdlZNYzBhQWc4?=
 =?utf-8?B?cGgyTEF5UE1OQU5iRXpXMG0vdHcvb1dtaUM2YWh0M2U3alJDVGEzM2RsMlpP?=
 =?utf-8?B?VDFaYnBRWFY1SHh6Wi9DcHl4OE81NFNVYXNRT3RWWUxoNnFoTWFaNUIyN3FV?=
 =?utf-8?B?UnRxL0VVL1V5dGpIbFpEMTU5NDZDeWhuNjhNRFk2OC9wcFB1ZkplbldFZ29z?=
 =?utf-8?B?cGdxbEp5a29JQTExSlY5WmRNbGNHaUl6bE1CZXNuaHVQanhsalNUc0Ywd3B1?=
 =?utf-8?B?VkU4ZVRWYWdsQ0tHTWo2L2hRbFNaY1lRUEdSVE1HNnpacUNGS2tJdjJLSmpH?=
 =?utf-8?B?bWFveWR6dUFBL2RkYXlTQXA5R2l6S3E2WDlwMWJDZ2o2TEJHWFJEUVhSQW5s?=
 =?utf-8?B?WFd0azJSSlRyNVIvR25wWG9pQXJoMkZFYmV0RXpsS0s3eVozSjBXY0dIWHVh?=
 =?utf-8?B?bnpsWER4N0JYZnAvS1pEOURwbW14NW8rTFU5Ym1Ddmh4cUczMk5FOFU5dUtV?=
 =?utf-8?B?Y1c4R3NaVUNhSEY0TThWWmsxbXhPZkhkTDhSdVUwSmJva3Q2MVZSYzlSS3Bj?=
 =?utf-8?B?RlpWMzdmNER1RmpZazB3MFhtQ2FDanBlT0FnaHREeDZqNk5KM09sNnNSYUVn?=
 =?utf-8?B?c1ZIajJpRERHTHd5amFseGRBTllOL0p4Z2lSNEl1WDY3NEQ3b2hLUTY2VVRH?=
 =?utf-8?B?SnpZa09WQW5KTEdnUDl1dlRwT0x2QUtKdXBZVlJGMWhoUnM3aXZSdlRjOFNV?=
 =?utf-8?B?RWpCTks4RzkwUzJPdUJyTmJ1SnBTQUxhaTdic3dLWTU5TDUvM2lWUHNjOWYv?=
 =?utf-8?B?T25UeWlEOUlIalNycS9MQlprUGdDQ3J6L2srT0tNZU42b3IyMzh2bC9ZcmZJ?=
 =?utf-8?B?d3NLRUVvRjZDVXlmVkpGK1o4VWJTZisrVGRGcmlOWE5lMTEwK2FRVHlXVHBk?=
 =?utf-8?B?UUZVcXVpZXo2TjNIR2k0SzluZ1hQOEVLaUNPcW9WRTdCaEtRSnp1c29EUkRJ?=
 =?utf-8?B?ZjkvenpEY2V1TElBY2VGSk4vRHdSK1Z4dGZJYTVmRHE0OFBEWTVYamZpQTVX?=
 =?utf-8?B?ZFJWTlJVMllNVHNNNWMwM2ErZ0tOcmZ5S1dqQ0sveko4YmhWSlpnb2pHY0hD?=
 =?utf-8?Q?XOiie/g8aBpKY=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: fc5e383a-f625-491b-1083-08dbc4e560fd
X-MS-Exchange-CrossTenant-AuthSource: MW5PR10MB5738.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Oct 2023 14:22:46.0244
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: gqMqNIr5Z3Ng8Ddr+7+F3qW7NiCAPgJH/jat/ZPmJMCL9LfI4p9VB2Lx+zmyl9VF0CQagqx7XN3XhPVP90wkoYpu0kpJ698QCJeE+pQJ5yM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PR10MB7301
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.267,Aquarius:18.0.980,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-10-04_06,2023-10-02_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxscore=0 bulkscore=0
 adultscore=0 mlxlogscore=970 phishscore=0 spamscore=0 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2309180000
 definitions=main-2310040104
X-Proofpoint-GUID: DOlYMkqsc7GfS_X2c2PHBu8sngfpGyb1
X-Proofpoint-ORIG-GUID: DOlYMkqsc7GfS_X2c2PHBu8sngfpGyb1
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (howler.vger.email [0.0.0.0]); Wed, 04 Oct 2023 07:23:14 -0700 (PDT)

On 10/4/23 12:47AM, Manas Ghandat wrote:
> Currently while searching for dmtree_t for sufficient free blocks there
> is an array out of bounds while getting element in tp->dm_stree. To add
> the required check for out of bound we first need to determine the type
> of dmtree. Thus added an extra parameter to dbFindLeaf so that the type
> of tree can be determined and the required check can be applied.

Applied to jfs-next

Thanks,
Shaggy

> 
> Reported-by: syzbot+aea1ad91e854d0a83e04@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=aea1ad91e854d0a83e04
> Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
> ---
> V2 -> V3: Changed the argument name from type to is_ctl
> V1 -> V2: Updated dbFindLeaf function.
> 
>   fs/jfs/jfs_dmap.c | 14 ++++++++++----
>   1 file changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index a14a0f18a4c4..d2a4fced8976 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -87,7 +87,7 @@ static int dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno,
>   static int dbExtend(struct inode *ip, s64 blkno, s64 nblocks, s64 addnblocks);
>   static int dbFindBits(u32 word, int l2nb);
>   static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno);
> -static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx);
> +static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl);
>   static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
>   		      int nblocks);
>   static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno,
> @@ -1709,7 +1709,7 @@ static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno)
>   		 * dbFindLeaf() returns the index of the leaf at which
>   		 * free space was found.
>   		 */
> -		rc = dbFindLeaf((dmtree_t *) dcp, l2nb, &leafidx);
> +		rc = dbFindLeaf((dmtree_t *) dcp, l2nb, &leafidx, true);
>   
>   		/* release the buffer.
>   		 */
> @@ -1956,7 +1956,7 @@ dbAllocDmapLev(struct bmap * bmp,
>   	 * free space.  if sufficient free space is found, dbFindLeaf()
>   	 * returns the index of the leaf at which free space was found.
>   	 */
> -	if (dbFindLeaf((dmtree_t *) & dp->tree, l2nb, &leafidx))
> +	if (dbFindLeaf((dmtree_t *) &dp->tree, l2nb, &leafidx, false))
>   		return -ENOSPC;
>   
>   	if (leafidx < 0)
> @@ -2920,14 +2920,18 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval)
>    *	leafidx	- return pointer to be set to the index of the leaf
>    *		  describing at least l2nb free blocks if sufficient
>    *		  free blocks are found.
> + *	is_ctl	- determines if the tree is of type ctl
>    *
>    * RETURN VALUES:
>    *	0	- success
>    *	-ENOSPC	- insufficient free blocks.
>    */
> -static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx)
> +static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
>   {
>   	int ti, n = 0, k, x = 0;
> +	int max_size;
> +
> +	max_size = is_ctl ? CTLTREESIZE : TREESIZE;
>   
>   	/* first check the root of the tree to see if there is
>   	 * sufficient free space.
> @@ -2948,6 +2952,8 @@ static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx)
>   			/* sufficient free space found.  move to the next
>   			 * level (or quit if this is the last level).
>   			 */
> +			if (x + n > max_size)
> +				return -ENOSPC;
>   			if (l2nb <= tp->dmt_stree[x + n])
>   				break;
>   		}