Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/fs/ocfs2
History
Dmitry Antipov c6a4ad37e7 ocfs2: fix UBSAN warning in ocfs2_verify_volume() 
commit 23aab037106d46e6168ce1214a958ce9bf317f2e upstream.

Syzbot has reported the following splat triggered by UBSAN:

UBSAN: shift-out-of-bounds in fs/ocfs2/super.c:2336:10
shift exponent 32768 is too large for 32-bit type 'int'
CPU: 2 UID: 0 PID: 5255 Comm: repro Not tainted 6.12.0-rc4-syzkaller-00047-gc2ee9f594da8 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x241/0x360
 ? __pfx_dump_stack_lvl+0x10/0x10
 ? __pfx__printk+0x10/0x10
 ? __asan_memset+0x23/0x50
 ? lockdep_init_map_type+0xa1/0x910
 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420
 ocfs2_fill_super+0xf9c/0x5750
 ? __pfx_ocfs2_fill_super+0x10/0x10
 ? __pfx_validate_chain+0x10/0x10
 ? __pfx_validate_chain+0x10/0x10
 ? validate_chain+0x11e/0x5920
 ? __lock_acquire+0x1384/0x2050
 ? __pfx_validate_chain+0x10/0x10
 ? string+0x26a/0x2b0
 ? widen_string+0x3a/0x310
 ? string+0x26a/0x2b0
 ? bdev_name+0x2b1/0x3c0
 ? pointer+0x703/0x1210
 ? __pfx_pointer+0x10/0x10
 ? __pfx_format_decode+0x10/0x10
 ? __lock_acquire+0x1384/0x2050
 ? vsnprintf+0x1ccd/0x1da0
 ? snprintf+0xda/0x120
 ? __pfx_lock_release+0x10/0x10
 ? do_raw_spin_lock+0x14f/0x370
 ? __pfx_snprintf+0x10/0x10
 ? set_blocksize+0x1f9/0x360
 ? sb_set_blocksize+0x98/0xf0
 ? setup_bdev_super+0x4e6/0x5d0
 mount_bdev+0x20c/0x2d0
 ? __pfx_ocfs2_fill_super+0x10/0x10
 ? __pfx_mount_bdev+0x10/0x10
 ? vfs_parse_fs_string+0x190/0x230
 ? __pfx_vfs_parse_fs_string+0x10/0x10
 legacy_get_tree+0xf0/0x190
 ? __pfx_ocfs2_mount+0x10/0x10
 vfs_get_tree+0x92/0x2b0
 do_new_mount+0x2be/0xb40
 ? __pfx_do_new_mount+0x10/0x10
 __se_sys_mount+0x2d6/0x3c0
 ? __pfx___se_sys_mount+0x10/0x10
 ? do_syscall_64+0x100/0x230
 ? __x64_sys_mount+0x20/0xc0
 do_syscall_64+0xf3/0x230
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f37cae96fda
Code: 48 8b 0d 51 ce 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1e ce 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007fff6c1aa228 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff6c1aa240 RCX: 00007f37cae96fda
RDX: 00000000200002c0 RSI: 0000000020000040 RDI: 00007fff6c1aa240
RBP: 0000000000000004 R08: 00007fff6c1aa280 R09: 0000000000000000
R10: 00000000000008c0 R11: 0000000000000206 R12: 00000000000008c0
R13: 00007fff6c1aa280 R14: 0000000000000003 R15: 0000000001000000
 </TASK>

For a really damaged superblock, the value of 'i_super.s_blocksize_bits'
may exceed the maximum possible shift for an underlying 'int'.  So add an
extra check whether the aforementioned field represents the valid block
size, which is 512 bytes, 1K, 2K, or 4K.

Link: https://lkml.kernel.org/r/20241106092100.2661330-1-dmantipov@yandex.ru
Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Reported-by: syzbot+56f7cd1abe4b8e475180@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=56f7cd1abe4b8e475180
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-12-17 13:20:51 +01:00
..
cluster Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlmfs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
acl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
acl.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
alloc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
alloc.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
aops.c Revert "ocfs2: fix uninit-value in ocfs2_get_block()" 2024-11-24 00:23:03 +01:00
aops.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
blockcheck.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
blockcheck.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
buffer_head_io.c Revert "ocfs2: remove unreasonable unlock in ocfs2_read_blocks" 2024-11-24 00:23:02 +01:00
buffer_head_io.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dcache.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dcache.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dir.c ocfs2: add bounds checking to ocfs2_check_dir_entry() 2024-11-19 14:19:51 +01:00
dir.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlmglue.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dlmglue.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
export.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
export.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
extent_map.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
extent_map.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
file.c fs: Fix uninitialized value issue in from_kuid and from_kgid 2024-11-30 02:33:28 +01:00
file.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
filecheck.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
filecheck.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
heartbeat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
heartbeat.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
inode.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
inode.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ioctl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ioctl.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
journal.c Revert "ocfs2: fix null-ptr-deref when journal load failed." 2024-11-24 00:23:02 +01:00
journal.h ocfs2: fix DIO failure due to insufficient transaction credits 2024-11-19 14:19:33 +01:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
localalloc.c Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume" 2024-11-24 00:23:03 +01:00
localalloc.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
locks.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
locks.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mmap.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mmap.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
move_extents.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
move_extents.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
namei.c ocfs2: use coarse time for new created files 2024-11-19 14:19:04 +01:00
namei.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ocfs1_fs_compat.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ocfs2.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ocfs2_fs.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ocfs2_ioctl.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ocfs2_lockid.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ocfs2_lockingver.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ocfs2_trace.h ocfs2: fix DIO failure due to insufficient transaction credits 2024-11-19 14:19:33 +01:00
quota.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
quota_global.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
quota_local.c Revert "ocfs2: cancel dqi_sync_work before freeing oinfo" 2024-11-24 00:23:03 +01:00
refcounttree.c Revert "ocfs2: reserve space for inline xattr before attaching reflink tree" 2024-11-24 00:23:03 +01:00
refcounttree.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reservations.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reservations.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
resize.c ocfs2: uncache inode which has failed entering the group 2024-12-17 13:20:50 +01:00
resize.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
slot_map.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
slot_map.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stack_o2cb.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stack_user.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stackglue.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stackglue.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
suballoc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
suballoc.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
super.c ocfs2: fix UBSAN warning in ocfs2_verify_volume() 2024-12-17 13:20:51 +01:00
super.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
symlink.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
symlink.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysfile.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysfile.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uptodate.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uptodate.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xattr.c ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() 2024-11-30 02:33:26 +01:00
xattr.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00