Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) client-ip=2620:137:e000::3:2;
Message-ID: <5b131b90-513c-4442-bc1f-07817023df71@oracle.com>
Date:   Wed, 1 Nov 2023 10:04:55 -0500
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] jfs : fix array-index-out-of-bounds in diWrite
Content-Language: en-US
To:     Manas Ghandat <ghandatmanas@gmail.com>, shaggy@kernel.org
Cc:     Linux-kernel-mentees@lists.linuxfoundation.org,
        jfs-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org,
        syzbot+c1056fdfe414463fdb33@syzkaller.appspotmail.com
References: <20231008174745.27342-1-ghandatmanas@gmail.com>
From:   Dave Kleikamp <dave.kleikamp@oracle.com>
In-Reply-To: <20231008174745.27342-1-ghandatmanas@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?dFVuYktTY3VLOXNvN0NxM3VFNXRUeDhmOXgyOGpHYXJwMytMUGZuSkw3cVlT?=
 =?utf-8?B?MjNPNGFwUmNEbHdPWEFWYXdQL09JczVkS2NKSkc4cHZZb09RY1MrcWpuS0tO?=
 =?utf-8?B?NFNGMkpsMW9yaUo2VHJEQ1VPanhZTWt2UURGdzFDN2VpVVhHbUFiTGIrVUpG?=
 =?utf-8?B?UWFrczJpejVxSEdnc3B3UGVxbklIY2UzbnFHMlI5VkgyYkg5RGI4cWoybDJ2?=
 =?utf-8?B?dGVBWlhXc1F3cUV4YXFFTFdiVEFZMUhray9NKzVkS0tFUml1TUJ5MkFWOFo4?=
 =?utf-8?B?RloxNCt1ZXl3K3BJR2dGOWdDTFpPd1JmeGNnRDVJaDJ1NStEQ3E2OGw3RWNu?=
 =?utf-8?B?eDc1YzNObHBDc3lhVDF4dnpQUzBzMUMya2kyc0g5bUJQazFTZ0tUWk5YTkpz?=
 =?utf-8?B?VS9RS21MNjA1Z1BDcE5iTHQ2dHBMeld4eE9wcGlyaEtzcTZENWNZTkgxQy9m?=
 =?utf-8?B?UmhlYlRSdVV5NndkdEE4Wnd1NkthUkRjZ3RxTzFzd0xmaWVWNlBaTkxsQjlZ?=
 =?utf-8?B?NkRCalZxcEVCS29udldUM1pyc0hoa2FtYmN6cXRkd0hKczNHTDlEYXRjdSsz?=
 =?utf-8?B?K2RoNkVEVDN4bjh0ZXcrS2dWTFM3ckxlZ2lhckcwZzczSjg5UjUxMlRkb2p1?=
 =?utf-8?B?bkVMbjgzdmRRWFBNLzVQakd2YnpuY01PTFFqT2g0ZUxpTTloMEkrUk9ldVJx?=
 =?utf-8?B?TmN2SE9SWGdRZDU4VytKYjVHSWtUVWo1dkdidU1FenM0RWNCMW03aUNxYzdG?=
 =?utf-8?B?Rm1PcDFGT3pXYkFzSlFrbFhjWkFBZ25BM2tMUEg5c0ZMUGNMSUxQdGFkWFpY?=
 =?utf-8?B?ZUVOMGJZUVJJb3JQRWFINzh3eTVaTW9scDdQdXZsTXFObnpOV25LaG1xS1dD?=
 =?utf-8?B?ak9aUHhhNDRySmJEU0ZGYU5aN2N5TjR4Q0xNNituTngvTTJNSFRZbWFyZS9w?=
 =?utf-8?B?YlBCTFBUR2VqdVZqdWNUZ2R0cnRpalpFVWU3aENJTC9yUUtkUXlUOE1xUEI5?=
 =?utf-8?B?RHdETEZjMVV4WDhycDNNQnc0NHFRLzZaK0V2ZTRHZ0tOWlpGbStUYUZiVzBK?=
 =?utf-8?B?cVc4TENrS2tQRlJzN0dZaEx0dVNLUm5uTHQ4dVdEWllSZCtOb3J6MVdGaGpO?=
 =?utf-8?B?Rnd4bUd0d1MwTmFJY3JmQ1VBWHpGWWtCWW8yYW8wdy9hSEMwcjErTmoxbm1H?=
 =?utf-8?B?eHorenJvenJHa3M0ZUFQdkNhZnQ0UWlIT2ZxNzBsb1ZtZENoTHJHaFB2NVBV?=
 =?utf-8?B?YUQ3ZWIydGFXbi9vQURWTU9yaDJUV1dHL2NabzFpYVYyMHBPMml0elpVUS9j?=
 =?utf-8?B?d3hzSlhLNlhhUXQzci9CQ0djbmxibDJpbU4rRC9iZmtpTjVzNURBUHcveHI0?=
 =?utf-8?B?NXdneUNYZVVLRk5uekNaVjJJOTdVL1luaGJCWnJtem84VjdmR0dBMGVDaEE5?=
 =?utf-8?B?UFZqQXYrT3FEMktJWkFRNUNldmVzRXAxR1BqSThwbmVIZFU3WW5QdUtSZVdP?=
 =?utf-8?B?cDhBelB3NHUvMzRHUjIyNUtEajFjb3ZhdXZBWGk0ci8wYnpKbU5xanh5aTVL?=
 =?utf-8?B?UTB1SzFkWnNyOGF0cTRZb3dkaWdOZzZSYzRvV1psSEt0dHliYmRyY1BldThP?=
 =?utf-8?B?czNsWVhzc3lMSGFtNDF6RjEydittOGJMMzYvYXZRS0pGeHQyZlNMNGZ0a3lD?=
 =?utf-8?B?OXRXMGUrRTNGVGdSSnEveWRYRUU4Y2wyNGVOVlpRcnUxQ1dHKzhqY1M2LzJy?=
 =?utf-8?B?OCtaODdrNGFiclV5alVhNkpCVldRY285aW50QlgwYStxWXJPSnFldGl0U3Zw?=
 =?utf-8?B?aTJUQlFML0MzRkw0OWZyditYMVc3UUc1cTk0WTJKT1d0QkphbEorUWVLRzRk?=
 =?utf-8?B?cEdUVU5BckhEVkdqazJhOUdSdStwZHhWU1JVTENoSzdvMlFueTA2U3o2YUcv?=
 =?utf-8?B?RmxxaWFRcExlRHhVaU1KeWJSdHlKdGFock4zSHowUlFXNGlNNy9oVVZob3M0?=
 =?utf-8?B?L09PQ0hJeW5uQ05tUE1KMTIzclVQbURrMlFUR2UyZ1hQOVRQdEM1YjZ5OFM5?=
 =?utf-8?B?ZHhXWTZKdXVTWVBVU1hUeDhYbGgvVGRkNG83aXdrYjNPSzdpVFAybzhYdjYx?=
 =?utf-8?B?cXFwS25aeWZFQmtSVlU5VU1FOGo0c0gyTEttMnR1dDVYMGFFMThVREtTUUZs?=
 =?utf-8?B?clE9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?utf-8?B?aTZLcm9PNHBMSXJHbjFOblJmcFR6N2daaGtkUUs1Zmx6ektDK1c2d0Jxd3hx?=
 =?utf-8?B?Ni9Fa09HbExpNk5BblpDU3BuWDFrdFdRR0g0NHRrU3hucHhpYmdMRitWNjcy?=
 =?utf-8?B?VXUxYktjUVk4UkdObjBYbGJ5QXRWYUg0MXpPVVlMWFhHdW13em9DeFMzVXB5?=
 =?utf-8?B?NHZuMDI1Y1ZiNUF4YXV6YVN3SjVXbkRDcHozdzFTcXdWNVBJcGl6QWVUYVI5?=
 =?utf-8?B?aTdla0JEenJXUTNSQW9UL0wzRm50Z0NxZk11OFExK1JGU0s2RUFuQ0RNRE56?=
 =?utf-8?B?c0g0SUo3RkxkeFMzczEySlBPQ0ljWTczTjBzNytwTlFwTzJlK3NrSnB5elRY?=
 =?utf-8?B?TmpOKzFLSEhtcmhPTC8zWmg2TkxjM3gyNDkvRFlabWFwR29YSy9tcFdKeXZ2?=
 =?utf-8?B?WUJudWJUODZzMnV6Q3RaL2wwaDVlQkdTL0NGNzgxRVRrOVBsVXhCQ2pLRTdt?=
 =?utf-8?B?eVYvRWlxWndXV2V3NURQRnNLRzNKZlJYeXZGUUFZajBXMDNKMzFDM1Bpc21q?=
 =?utf-8?B?Q0VsT1AvZkRmRFBtVFovalNPY0lwWkZ1b2NoQk1TNXZWNGQ1eGxOK1ozR0NV?=
 =?utf-8?B?Z1IwRyt2S211L0QvTVRRL1BpS1BNZ09VZCs5OWJJTlpKT0xkWmNRU1N1WXhO?=
 =?utf-8?B?cks3VkxHMXVDNVZWOW9wQTR3TWpHNlVBdEVQeGhGSzZxRTN3bkl6a0EyczRa?=
 =?utf-8?B?K2dmOURiRUtVUWZCdE1kOG55NWUydWVDVW14NSt2MTNDK1UxeXhNY2Nna2cv?=
 =?utf-8?B?TXJsTGJzY2EwdHBSZCt2UzN6K0xuKzJiRGRXNEU3UitPQjBEeXJySUpoY2RL?=
 =?utf-8?B?bFZGY3pFYkhNK2NLdWVNZTVHZkluQ3U5RlRtcWZOellDdG1ub0V1cU45QlZQ?=
 =?utf-8?B?QTFkSThicmdEbm5oMlQyS1dyN28vNGJvK3lNdUtoWmw1UmNOQ25iZHBSdXhP?=
 =?utf-8?B?Qkc5aHAvTHRFNjYycFZIeU5pcXlrTTNnc0ltQ1NwUTM3Z2hXdWtvSHdHZExE?=
 =?utf-8?B?bWtxdmNlMENTTlkrRlJQY0FxRXh2cUtkZ3VjcDFWSkoyejBPYVZSUXV1eU83?=
 =?utf-8?B?Z3NrMXYyNkg4aEhUQ0RxNStRM2l0bjk1UFRQZkxLdGNZZ2x3V1pDVWlMR2xI?=
 =?utf-8?B?VmRJV3NkNnM1em1zU0JFcGxwV1JsTjhvOGh1S2ljMW9DRnNtVDVCd0p0YVdh?=
 =?utf-8?B?bnNMeG5lZ2pQQVoyN2NXanBJRTFqSXFoOThpeGxHazVISGdnbE00N1Rncy9N?=
 =?utf-8?B?dlhYcGdhUmt1MzRlTTBvUFhBSm9PMHBHdEZIZ2lpd3owSzFHTTNFNm5VTGp3?=
 =?utf-8?Q?19aBTbnioC/T1QPE/4dazv81MFN3m+rUKk?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 10e50842-a616-4a3f-da86-08dbdaebe978
X-MS-Exchange-CrossTenant-AuthSource: MW5PR10MB5738.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Nov 2023 15:04:57.4127
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: gKQNvgv4gDqM9jxaGS2Qwp5WRrMNeGhdRV0ZQAk3pTTmU3DV3F12XlL8vIcPrkAeY7B7/kJlN6lgbHwqF56ai3Bbw9hGZxlgHJaOH0qJaC0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR10MB6230
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.987,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-11-01_13,2023-11-01_02,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 suspectscore=0 spamscore=0
 phishscore=0 mlxlogscore=891 adultscore=0 mlxscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2310240000
 definitions=main-2311010126
X-Proofpoint-ORIG-GUID: T1DOLoeOkGT8rpFntV8LIAcQd0qFHcu3
X-Proofpoint-GUID: T1DOLoeOkGT8rpFntV8LIAcQd0qFHcu3
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED
	autolearn=unavailable autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on agentk.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (agentk.vger.email [0.0.0.0]); Wed, 01 Nov 2023 08:07:15 -0700 (PDT)

On 10/8/23 12:47PM, Manas Ghandat wrote:
> Currently while copying dtree root from inode to dnode in the xp slot
> there is a out of bound memcpy. Added a bound check to the memcpy.
> 
> Reported-by: syzbot+c1056fdfe414463fdb33@syzkaller.appspotmail.com
> Fixes: https://syzkaller.appspot.com/bug?extid=c1056fdfe414463fdb33
> Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
> ---
>   fs/jfs/jfs_imap.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
> index 799d3837e7c2..d1f897848be0 100644
> --- a/fs/jfs/jfs_imap.c
> +++ b/fs/jfs/jfs_imap.c
> @@ -746,7 +746,8 @@ int diWrite(tid_t tid, struct inode *ip)
>   		xp = (dtpage_t *) & dp->di_dtroot;
>   		lv = ilinelock->lv;
>   		for (n = 0; n < ilinelock->index; n++, lv++) {
> -			memcpy(&xp->slot[lv->offset], &p->slot[lv->offset],
> +			if (lv->offset < 128)

I'd use DTPAGEMAXSLOT instead of hard-coding 128.

Also, we could at least set rc to -EIO, or we could do something more.
Calling jfs_error() would mark the superblock dirty and usually makes 
the file system read-only until it's fixed.

> +				memcpy(&xp->slot[lv->offset], &p->slot[lv->offset],
>   			       lv->length << L2DTSLOTSIZE);
>   		}
>   	} else {