Received-SPF: pass (google.com: domain of linux-kernel+bounces-42930-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Message-ID: <a25c75af-c961-4ca6-9810-dbcfe64753d5@oracle.com>
Date: Mon, 29 Jan 2024 08:39:18 -0600
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] jfs: fix shift-out-of-bounds in dbJoin
Content-Language: en-US
To: Matthew Wilcox <willy@infradead.org>,
        Manas Ghandat <ghandatmanas@gmail.com>
Cc: Linux-kernel-mentees@lists.linuxfoundation.org,
        jfs-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org,
        syzbot+411debe54d318eaed386@syzkaller.appspotmail.com,
        Sasha Levin <sashal@kernel.org>
References: <20231011143937.31996-1-ghandatmanas@gmail.com>
 <Zba9zRWq6rZhWn-p@casper.infradead.org>
From: Dave Kleikamp <dave.kleikamp@oracle.com>
In-Reply-To: <Zba9zRWq6rZhWn-p@casper.infradead.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?V1k3a3hQMmNnYnFhUWhMejBXWFFGamdIK1BZZ1F1Q1BpWjFsUDFmMTJXR0cz?=
 =?utf-8?B?Z0N2L3QwYnoxakh2WmhJTGRFMkcwVTBGQWQzbTBNRndEK0dyV3FXMjYyOVN3?=
 =?utf-8?B?dnFab0lMbEU2ejlHVFQ0Z2p6VnZmWjl5YmhNUUVhQW1PRmYzNlYxc3R2azVL?=
 =?utf-8?B?VENhdlh0OXoxOEZtNWNYYVppOXcrZnE4VEhURWFqbjBKYi9zT1QxRlFuSlcr?=
 =?utf-8?B?Z0RtemFlRjM4UFpZbWI3ZEpRVXdpU210eExQZjUrQldqNy9aOHZmQXF4Tysv?=
 =?utf-8?B?cmRLNFZvdWd2UVc5Qys0S2I3VTRZOTFaeWk2L2EzOWl4VlVzRFYzSXNKbWxW?=
 =?utf-8?B?NFRCNWt6N1VzN25hU1RITUlTV3U1U3JzT0R6U1B2MFl5RDVna3BqQkRCNmx1?=
 =?utf-8?B?VExyMEhrbys1aG9VU0h5dlFqTWhmYzFLcjNZZ0hlaU84U3NOMWVqVGFrQ3pU?=
 =?utf-8?B?S1lyTjlOUyt0RFBNcWFWMk5FSHgrTTlGUEJGYWk1dW52elpvS0J4OHVZZFh1?=
 =?utf-8?B?VDZxRW1GaGhRUHFRc0huRldMQU5leStoUmVkRnpCVUNza0hPalpYdkZJYlRh?=
 =?utf-8?B?Nll6c25iRlA2VzVJbGppMUQ2bWp1T3NucURtSmg3OXNPbDVxMzkrSG5yVHRq?=
 =?utf-8?B?c1p3aGdmSk9pQysvMHFOdEo1bjFJaVV4SmVqUGwzbnNXbEJCaktiU2lVLzFT?=
 =?utf-8?B?Q3l2QnJnZmJwb0w3VGJ1cWZXbHNZVzN5bkpNd0F4Myt6dHpQSVloRUFFSzZu?=
 =?utf-8?B?K0tNZWMwZlJCOVNwWG5iOE4vdm9vMHZyQjFQMEZGTXZuV2d3QnNtYmNRM1Vv?=
 =?utf-8?B?bmJaaHQ0Yk4rYlQ3WGRpcFcrVHJZby9tSDA1dVdENURaMGQ3RlZFWTY4eWo4?=
 =?utf-8?B?cC8vRnpjTlNwaFU0elNyd01qV1RQT0NFOHhxaXNTY1N1bmt6K25JbFRGeHBO?=
 =?utf-8?B?dG1ldmJjMkp5MTdsb0tiNDM1SE9Udlh5NTZSdW9icXhRQ1NIellCZ0k2S2cy?=
 =?utf-8?B?eGpUS2RhMHhpRnNhRHl6dUFOQlVtZ3VZVHBVYTdhOUprN1dtZ2hJd0NDMlY0?=
 =?utf-8?B?R2ZPVnZLUHNCS0RZZkRmSnJhR2dmYWxONXlWak1TMGd6bmtpMDZmR09FeExF?=
 =?utf-8?B?bG42Q2hRbU14dnY0WXYyanJtYk1GcUlBL3B1RWdEcEJtRnJUb083b2dsazlh?=
 =?utf-8?B?Um5pZFIwc1FDVHhkN3kycTdJcHlFZHJtVjF5N0JYMGdKaVY0bW9ONmZFV3RR?=
 =?utf-8?B?SjkrZzJwTy9TOGw4WCtBL1pmbmlhcGNPalJLd2tUbDkzWkJCTmFaR3lMY1pk?=
 =?utf-8?B?d1RWN05xaklzZ1NPVkNhWXppMUpwMmZXWncvSTNmL3VxZ1VYT3lUU0tUZW14?=
 =?utf-8?B?U1BWQS9xdGhIVm5GQytwTDJhTEkyS05IellqQUpPaWJnYnRwRVFGcGQ0TTNh?=
 =?utf-8?B?bUMvbm14TzJ3U3JWbzhrdDdyRHU4cUYrV3BvQXp5VTNrSElKYmJpQ3dzK0F3?=
 =?utf-8?B?THRUcWRoVmp1VG9tWmloMFBkM3l6YTRUcFpIT3ZaZEpmNzl4YzZKZEJlMHNB?=
 =?utf-8?B?VUVqcHdsWnhZdWtZVjRoVk1uWjlOMEo3MTdaR1Ayb28xemE3YTFEOGs3TDN5?=
 =?utf-8?B?TitBSEkyc1p0SG9ENDVkUThGK20vL2tTTUt1UnZEam01YzZVb0tqa2ZYS1pS?=
 =?utf-8?B?ZkVVMkViVEtWWlNVekZ4ZG4wMGZMN1dJd0dIakRGVUJ1Y2tXbU54ZUdoSVdH?=
 =?utf-8?B?TGZTZ1ExR2dhc1lFYTgyZHNJdnFsL29oUTJFRDlvZHliK0J5SXN2V0NsMHVi?=
 =?utf-8?B?WW12VzZvWVlaU2dtaytDdlEwaUZJeUhYWk43K3FVMklSUXdBSTV3akdSRjlH?=
 =?utf-8?B?Z0phdjRBZnkzWld6S0Z3Tm03OHB2alQ4QUNoZ3Exd1o2QXRBcURXUTZFek5E?=
 =?utf-8?B?QWhSYk9yNEM5NVVNOG95Yk5neUhvK0kyb1ZmcS96VXMxbXpKODF2cTU1Nm0w?=
 =?utf-8?B?YzkwbU9yV2k2eXVkbk5VRTFtSCtEOHkrTkdFV0NIcm1FclN2aXBwQnZIai9x?=
 =?utf-8?B?SGEzdlJKMlpJSHZSSVJlNjZxOVoraXlzeXRrRmtjSXlCbmtJckJaM0hFdmZC?=
 =?utf-8?B?d1BSWGRpOEluakpSU0k0UEkxZHdzcDJzZWl0ZmlyNGNLcFdLQ0JENUEza3B5?=
 =?utf-8?B?eEE9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	/YfAfinF4EfhepsFa7GAN16qyem3C/MI/1dkIu/rFpzThqt/SunhPioUuxQ5YdV20DkI8qumMze+0T1diZPC+OPCtBrTdO5uVzcqBcGojAgyGbqICV73ETLfrYlaPAyDj1WX2+yQ5T9dPB9RuWyW80s3XQOc6iCU1vWoy4/TEt6yXL20AYWk+bLtI9YArfiq/UeIJHAEX9dDr8DEc9l4hgjQ0Fb8he1RF5ZNYs9XWvwXA68cgnBBMcxEYsUSmB6W4IieJ0EyIOr2gDdJl8Z3W63UtJHSN0MyyRkSxeCYtejj6vSmAIAMjIr2OWhwnGsbuvbjEPhFxMk1xE+eqchU0YQoDDElfWsYJ+Yz5xu9YbzXMgufNmtZZ4tSVi1Z2dWj+tQSurxqnW2960zNoA+e76oZkowFm3jl0HYNihlIQw/LCAb+ZGuY5p4XgJg1MCJfYwqigqdwsUFfADgYmWNGQYxASO+XgRPvE83qTX39TtAAaCkSR6VZrYHSnXqR4AvG7HQd2cITvRsJPLX4aInSeLB4ayT31TiUV/2OBcxqzcL83FRGuiCRudWXqQ6J4FCVRE1o0zmOGy8UAx4hl9ZuYy2zBK9d/VRJBvh15MPqSIg=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f8d82746-b366-44aa-a262-08dc20d81543
X-MS-Exchange-CrossTenant-AuthSource: MW5PR10MB5738.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jan 2024 14:39:22.2626
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: bHfB2cRQvcYJh2lq3PEIifDq0LHLvZ+XU3hmHxzIdASncEUGzU3bloZLvlhrwqE4wi6IK6wBvRTwgNwNZqk8PWXx3v8LYWpQyfOANq8hHnw=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5212
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-01-29_07,2024-01-29_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 phishscore=0 malwarescore=0
 spamscore=0 mlxlogscore=999 adultscore=0 bulkscore=0 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000
 definitions=main-2401290107
X-Proofpoint-ORIG-GUID: 2WVAEssriYnsFvUxzMwcRUYoyjIZuDer
X-Proofpoint-GUID: 2WVAEssriYnsFvUxzMwcRUYoyjIZuDer

On 1/28/24 2:49PM, Matthew Wilcox wrote:
> On Wed, Oct 11, 2023 at 08:09:37PM +0530, Manas Ghandat wrote:
>> Currently while joining the leaf in a buddy system there is shift out
>> of bound error in calculation of BUDSIZE. Added the required check
>> to the BUDSIZE and fixed the documentation as well.
> 
> This patch causes xfstests to fail frequently.  The one this trace is
> from was generic/074.

Thanks for catching this. The sanity test is not right, so we need to 
revert that one.

Shaggy

> 
> Sasha, I see this one was AUTOSEL.  Please stop it from going into
> -stable.
> 
> 00274 [failed, exit status 1]------------[ cut here ]------------
> 00274 kernel BUG at fs/jfs/inode.c:169!
> 00274 invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
> 00274 CPU: 7 PID: 52174 Comm: umount Kdump: loaded Tainted: G                 N 6.7.0-rc2-00020-gcca974daeb6c #442
> 00274 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> 00274 RIP: 0010:jfs_evict_inode+0xfb/0x110
> 00274 Code: 28 fc ff ff a8 04 75 24 4d 85 e4 74 10 49 83 7c 24 80 00 74 08 48 89 df e8 e2 a5 00 00 48 89 df e8 3a 95 ee ff e9 2f ff ff ff <0f> 0b 48 89 df e8 0b 28 00 00 eb d2 66 0f 1f 84 00 00 00 00 00 90
> 00274 RSP: 0018:ffff8880080bbd48 EFLAGS: 00010287
> 00274 RAX: ffff88804b209a80 RBX: ffff88804b209df8 RCX: 0000000000000000
> 00274 RDX: ffff88800b813ce0 RSI: ffffffff8217a259 RDI: ffff88804b209df8
> 00274 RBP: ffff8880080bbd58 R08: 0000000000000001 R09: 0000000000000001
> 00274 R10: ffff8880551e4540 R11: 0000000000000001 R12: ffff88804b209fa8
> 00274 R13: ffffffff81e35fa0 R14: ffff88800eaae7d0 R15: ffff88800eaae7d0
> 00274 FS:  00007f4f5784a840(0000) GS:ffff88807d9c0000(0000) knlGS:0000000000000000
> 00274 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> 00274 CR2: 00007f4f57ae2c00 CR3: 000000000a5c4005 CR4: 0000000000770eb0
> 00274 PKRU: 55555554
> 00274 Call Trace:
> 00274  <TASK>
> 00274  ? show_regs+0x60/0x70
> 00274  ? die+0x32/0x90
> 00274  ? do_trap+0xbf/0xe0
> 00274  ? do_error_trap+0x75/0x110
> 00274  ? jfs_evict_inode+0xfb/0x110
> 00274  ? exc_invalid_op+0x52/0x70
> 00274  ? jfs_evict_inode+0xfb/0x110
> 00274  ? asm_exc_invalid_op+0x1b/0x20
> 00274  ? jfs_evict_inode+0xfb/0x110
> 00274  ? jfs_evict_inode+0x3a/0x110
> 00274  evict+0xcc/0x1d0
> 00274  dispose_list+0x48/0x80
> 00274  evict_inodes+0x14c/0x190
> 00274  generic_shutdown_super+0x34/0x160
> 00274  kill_block_super+0x16/0x40
> 00274  deactivate_locked_super+0x2d/0xa0
> 00274  deactivate_super+0x3b/0x50
> 00274  cleanup_mnt+0xbe/0x160
> 00274  __cleanup_mnt+0xd/0x20
> 00274  task_work_run+0x59/0xa0
> 00274  exit_to_user_mode_prepare+0x175/0x180
> 00274  syscall_exit_to_user_mode+0x1d/0x50
> 00274  do_syscall_64+0x4e/0xf0
> 00274  entry_SYSCALL_64_after_hwframe+0x6e/0x76
> 00274 RIP: 0033:0x7f4f57a76857
> 00274 Code: af 95 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 79 95 0c 00 f7 d8 64 89 02 b8
> 00274 RSP: 002b:00007fff75aa4be8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
> 00274 RAX: 0000000000000000 RBX: 00005586b9c30ad8 RCX: 00007f4f57a76857
> 00274 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00005586b9c343e0
> 00274 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000073
> 00274 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4f57bb1264
> 00274 R13: 00005586b9c343e0 R14: 00005586b9c30bf0 R15: 00005586b9c309c0
> 00274  </TASK>
> 00274 Modules linked in:
> 
> I haven't attempted to dig into why yet.
> 
>> Reported-by: syzbot+411debe54d318eaed386@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=411debe54d318eaed386
>> Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
>> ---
>>   fs/jfs/jfs_dmap.c | 8 +++++++-
>>   1 file changed, 7 insertions(+), 1 deletion(-)
>>
>> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
>> index 6b838d3ae7c2..baa97bda1c7a 100644
>> --- a/fs/jfs/jfs_dmap.c
>> +++ b/fs/jfs/jfs_dmap.c
>> @@ -2730,7 +2730,9 @@ static int dbBackSplit(dmtree_t * tp, int leafno)
>>    *	leafno	- the number of the leaf to be updated.
>>    *	newval	- the new value for the leaf.
>>    *
>> - * RETURN VALUES: none
>> + * RETURN VALUES:
>> + *  0		- success
>> + *	-EIO	- i/o error
>>    */
>>   static int dbJoin(dmtree_t * tp, int leafno, int newval)
>>   {
>> @@ -2757,6 +2759,10 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)
>>   		 * get the buddy size (number of words covered) of
>>   		 * the new value.
>>   		 */
>> +
>> +		if ((newval - tp->dmt_budmin) > BUDMIN)
>> +			return -EIO;
>> +
>>   		budsz = BUDSIZE(newval, tp->dmt_budmin);
>>   
>>   		/* try to join.
>> -- 
>> 2.37.2
>>