lkml.org 
[lkml]   [2020]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: UBSAN: array-index-out-of-bounds in dbAdjTree
From
Date
On 10/8/20 12:00 PM, butt3rflyh4ck wrote:
> I report a array-index-out-of-bounds bug (in linux-5.9.0-rc6) found by
> kernel fuzz.
>
> kernel config: https://github.com/butterflyhack/syzkaller-fuzz/blob/master/v5.9.0-rc6-config
>
> and can reproduce.
>
> the dmtree_t is that
> typedef union dmtree {
> struct dmaptree t1;
> struct dmapctl t2;
> } dmtree_t;
>
> the dmaptree is that
> struct dmaptree {
> __le32 nleafs; /* 4: number of tree leafs */
> __le32 l2nleafs; /* 4: l2 number of tree leafs */
> __le32 leafidx; /* 4: index of first tree leaf */
> __le32 height; /* 4: height of the tree */
> s8 budmin; /* 1: min l2 tree leaf value to combine */
> s8 stree[TREESIZE]; /* TREESIZE: tree */
> u8 pad[2]; /* 2: pad to word boundary */
> };
> the TREESIZE is totally 341, but the leafidx type is __le32.

Does this patch fix the problem?

jfs: Fix array index bounds check in dbAdjTree

Bounds checking tools can flag a bug in dbAdjTree() for an array index
out of bounds in dmt_stree. Since dmt_stree can refer to the stree in
both structures dmaptree and dmapctl, use the larger array to eliminate
the false positive.

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
---
fs/jfs/jfs_dmap.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/jfs/jfs_dmap.h b/fs/jfs/jfs_dmap.h
index 29891fad3f09..aa03a904d5ab 100644
--- a/fs/jfs/jfs_dmap.h
+++ b/fs/jfs/jfs_dmap.h
@@ -183,7 +183,7 @@ typedef union dmtree {
#define dmt_leafidx t1.leafidx
#define dmt_height t1.height
#define dmt_budmin t1.budmin
-#define dmt_stree t1.stree
+#define dmt_stree t2.stree

/*
* on-disk aggregate disk allocation map descriptor.
--
2.29.2
\
 
 \ /
  Last update: 2020-11-13 22:17    [W:0.062 / U:0.112 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site