From nobody Wed Oct 30 19:55:55 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9F97CCE79A9 for ; Tue, 19 Sep 2023 15:56:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231614AbjISP4N (ORCPT ); Tue, 19 Sep 2023 11:56:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56712 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230124AbjISP4L (ORCPT ); Tue, 19 Sep 2023 11:56:11 -0400 Received: from mail-pf1-x432.google.com (mail-pf1-x432.google.com [IPv6:2607:f8b0:4864:20::432]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E63AC93 for ; Tue, 19 Sep 2023 08:56:05 -0700 (PDT) Received: by mail-pf1-x432.google.com with SMTP id d2e1a72fcca58-690c6f4f6a5so632362b3a.2 for ; Tue, 19 Sep 2023 08:56:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1695138965; x=1695743765; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=nOHqs4qAkXtTB8hx364ax6AK99btnMvdjW46PwKkTo4=; b=FAm6Wrd5V8M3lDqXKcVpflMeWukDHevCpLo83ExB2YMf1ibAJsKMHDOD0iwsIPOOnv WERFAqkcbPNM8BZ1n2LN6bRz0C/vz9VL6I/RsWCV7CHWLVS0kwJ3IloiJcZ2oihGjmrV tngo8l/5pZF8qxenhMSqw5UQP1+0Bt9WBjbbb21QBds7DxDI6NGIWudwbie1QZPfxJ01 hTE58/1PyoCbPx/rW4kGMSSSTIlivZZocCSukcXvCnnItdS6+YgrAnxs/C802wNDBMOn /4HHWvOihPtpgX9xrieS+77h+Qnvc0ScaAnbu3m3m4Ujl5SPcUUqhWwksxMtG4MLFwF1 bP0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695138965; x=1695743765; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=nOHqs4qAkXtTB8hx364ax6AK99btnMvdjW46PwKkTo4=; b=t1z3nFiwSyDnXxvSuS4T6NGARuDvWXpgkp1jJQBMMcjWULwYwD/YBb2CcIz8vHm4DD /Ud9mSiKbC61JMmdHxkTDtXqzUYNawJd7G9m1xLmm3vhnWrn7+iWA8suGPaZ7t05C/V3 keETkaxB9E84Qjnq6t/O+wRepgjxwp5iopmpv72RkSKn24Ojb69CZI2ato0FmxVHfvse RzlLLWrkN9urWIR6rOQ8RYI3Mbi7mXsJoxOf/RrsTLh8fX7QlFVGBPedU2hlzJnodsRb FFeuKuIxOZNJ31Ru7C/TKPH4FM36pc/ONL/cVQibz0BiHg8pq4/zuSZmoecLxGSZBSAB 9Dqg== X-Gm-Message-State: AOJu0Yw0gw4S1djbwjNjk5egB/iVGqK6FO+YzFBmXHRimJSKQjz6zron jMr9uZlcD45TDf6rzEbuLws= X-Google-Smtp-Source: AGHT+IE0y3FysbDgGuSL0FvAtrT32Ve9Gq3DbLiI0l5tKFSTY2C0ADc+ebEoQua8RovmKSbfgcIckA== X-Received: by 2002:a05:6a21:47c6:b0:140:a25:1c1d with SMTP id as6-20020a056a2147c600b001400a251c1dmr9500637pzc.51.1695138965147; Tue, 19 Sep 2023 08:56:05 -0700 (PDT) Received: from manas-VirtualBox.iitr.ac.in ([103.37.201.177]) by smtp.gmail.com with ESMTPSA id bm1-20020a056a00320100b0068fece2c190sm8739890pfb.70.2023.09.19.08.56.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 Sep 2023 08:56:04 -0700 (PDT) From: Manas Ghandat To: shaggy@kernel.org Cc: Manas Ghandat , linux-kernel@vger.kernel.org, jfs-discussion@lists.sourceforge.net, Linux-kernel-mentees@lists.linuxfoundation.org, syzbot+0558d19c373e44da3c18@syzkaller.appspotmail.com Subject: [PATCH] jfs : fs array-index-out-of-bounds in txCommit Date: Tue, 19 Sep 2023 21:25:42 +0530 Message-Id: <20230919155542.4354-1-ghandatmanas@gmail.com> X-Mailer: git-send-email 2.37.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Currently there is no check for out of bound access for xad in the struct xtpage_t. Added the required check at various places for the same Signed-off-by: Manas Ghandat Reported-by: syzbot+0558d19c373e44da3c18@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D0558d19c373e44da3c18 Fixes: df0cc57e057f --- fs/jfs/jfs_txnmgr.c | 4 ++++ fs/jfs/jfs_xtree.c | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c index ce4b4760fcb1..6c6640942bed 100644 --- a/fs/jfs/jfs_txnmgr.c +++ b/fs/jfs/jfs_txnmgr.c @@ -1722,6 +1722,10 @@ static void xtLog(struct jfs_log * log, struct tbloc= k * tblk, struct lrd * lrd, jfs_err("xtLog: lwm > next"); goto out; } + if (lwm >=3D XTROOTMAXSLOT) { + jfs_err("xtLog: lwm out of range"); + goto out; + } tlck->flag |=3D tlckUPDATEMAP; xadlock->flag =3D mlckALLOCXADLIST; xadlock->count =3D next - lwm; diff --git a/fs/jfs/jfs_xtree.c b/fs/jfs/jfs_xtree.c index 2d304cee884c..57569c52663e 100644 --- a/fs/jfs/jfs_xtree.c +++ b/fs/jfs/jfs_xtree.c @@ -357,6 +357,9 @@ static int xtSearch(struct inode *ip, s64 xoff, s64 *ne= xtp, for (base =3D XTENTRYSTART; lim; lim >>=3D 1) { index =3D base + (lim >> 1); =20 + if (index >=3D XTROOTMAXSLOT) + goto out; + XT_CMP(cmp, xoff, &p->xad[index], t64); if (cmp =3D=3D 0) { /* @@ -618,6 +621,9 @@ int xtInsert(tid_t tid, /* transaction id */ memmove(&p->xad[index + 1], &p->xad[index], (nextindex - index) * sizeof(xad_t)); =20 + if (index >=3D XTROOTMAXSLOT) + goto out; + /* insert the new entry: mark the entry NEW */ xad =3D &p->xad[index]; XT_PUTENTRY(xad, xflag, xoff, xlen, xaddr); --=20 2.37.2