lkml.org 
[lkml]   [2021]   [Jan]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 32/63] f2fs: fix shift-out-of-bounds in sanity_check_raw_super()
    Date
    From: Chao Yu <yuchao0@huawei.com>

    commit e584bbe821229a3e7cc409eecd51df66f9268c21 upstream.

    syzbot reported a bug which could cause shift-out-of-bounds issue,
    fix it.

    Call Trace:
    __dump_stack lib/dump_stack.c:79 [inline]
    dump_stack+0x107/0x163 lib/dump_stack.c:120
    ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
    __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
    sanity_check_raw_super fs/f2fs/super.c:2812 [inline]
    read_raw_super_block fs/f2fs/super.c:3267 [inline]
    f2fs_fill_super.cold+0x16c9/0x16f6 fs/f2fs/super.c:3519
    mount_bdev+0x34d/0x410 fs/super.c:1366
    legacy_get_tree+0x105/0x220 fs/fs_context.c:592
    vfs_get_tree+0x89/0x2f0 fs/super.c:1496
    do_new_mount fs/namespace.c:2896 [inline]
    path_mount+0x12ae/0x1e70 fs/namespace.c:3227
    do_mount fs/namespace.c:3240 [inline]
    __do_sys_mount fs/namespace.c:3448 [inline]
    __se_sys_mount fs/namespace.c:3425 [inline]
    __x64_sys_mount+0x27f/0x300 fs/namespace.c:3425
    do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

    Reported-by: syzbot+ca9a785f8ac472085994@syzkaller.appspotmail.com
    Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
    Signed-off-by: Chao Yu <yuchao0@huawei.com>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/f2fs/super.c | 9 ++++-----
    1 file changed, 4 insertions(+), 5 deletions(-)

    --- a/fs/f2fs/super.c
    +++ b/fs/f2fs/super.c
    @@ -2744,7 +2744,6 @@ static int sanity_check_raw_super(struct
    block_t total_sections, blocks_per_seg;
    struct f2fs_super_block *raw_super = (struct f2fs_super_block *)
    (bh->b_data + F2FS_SUPER_OFFSET);
    - unsigned int blocksize;
    size_t crc_offset = 0;
    __u32 crc = 0;

    @@ -2778,10 +2777,10 @@ static int sanity_check_raw_super(struct
    }

    /* Currently, support only 4KB block size */
    - blocksize = 1 << le32_to_cpu(raw_super->log_blocksize);
    - if (blocksize != F2FS_BLKSIZE) {
    - f2fs_info(sbi, "Invalid blocksize (%u), supports only 4KB",
    - blocksize);
    + if (le32_to_cpu(raw_super->log_blocksize) != F2FS_BLKSIZE_BITS) {
    + f2fs_info(sbi, "Invalid log_blocksize (%u), supports only %u",
    + le32_to_cpu(raw_super->log_blocksize),
    + F2FS_BLKSIZE_BITS);
    return -EFSCORRUPTED;
    }


    \
     
     \ /
      Last update: 2021-01-04 17:11    [W:4.040 / U:0.220 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site