[v1] jfs: fix array-index-out-of-bounds read in add_missing_indices

[PATCH RESEND] jfs: fix array-index-out-of-bounds read in add_missing_indices

Posted by Aditya Dutt 10 months, 1 week ago

stbl is s8 but it must contain offsets into slot which can go from 0 to
127.

Added a bound check for that error and return -EIO if the check fails.
Also make jfs_readdir return with error if add_missing_indices returns
with an error.

Reported-by: syzbot+b974bd41515f770c608b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com./bug?extid=b974bd41515f770c608b
Signed-off-by: Aditya Dutt <duttaditya18@gmail.com>
---
 fs/jfs/jfs_dtree.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 93db6eec4465..de33026d18d2 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -2613,7 +2613,7 @@ void dtInitRoot(tid_t tid, struct inode *ip, u32 idotdot)
  *	     fsck.jfs should really fix this, but it currently does not.
  *	     Called from jfs_readdir when bad index is detected.
  */
-static void add_missing_indices(struct inode *inode, s64 bn)
+static int add_missing_indices(struct inode *inode, s64 bn)
 {
 	struct ldtentry *d;
 	struct dt_lock *dtlck;
@@ -2622,7 +2622,7 @@ static void add_missing_indices(struct inode *inode, s64 bn)
 	struct lv *lv;
 	struct metapage *mp;
 	dtpage_t *p;
-	int rc;
+	int rc = 0;
 	s8 *stbl;
 	tid_t tid;
 	struct tlock *tlck;
@@ -2647,6 +2647,16 @@ static void add_missing_indices(struct inode *inode, s64 bn)
 
 	stbl = DT_GETSTBL(p);
 	for (i = 0; i < p->header.nextindex; i++) {
+		if (stbl[i] < 0) {
+			jfs_err("jfs: add_missing_indices: Invalid stbl[%d] = %d for inode %ld, block = %lld",
+				i, stbl[i], (long)inode->i_ino, (long long)bn);
+			rc = -EIO;
+
+			DT_PUTPAGE(mp);
+			txAbort(tid, 0);
+			goto end;
+		}
+
 		d = (struct ldtentry *) &p->slot[stbl[i]];
 		index = le32_to_cpu(d->index);
 		if ((index < 2) || (index >= JFS_IP(inode)->next_index)) {
@@ -2664,6 +2674,7 @@ static void add_missing_indices(struct inode *inode, s64 bn)
 	(void) txCommit(tid, 1, &inode, 0);
 end:
 	txEnd(tid);
+	return rc;
 }
 
 /*
@@ -3017,7 +3028,10 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
 		}
 
 		if (fix_page) {
-			add_missing_indices(ip, bn);
+			if ((rc = add_missing_indices(ip, bn))) {
+				jfs_err("jfs_readdir: add_missing_indices returned %d", rc);
+				goto out;
+			}
 			page_fixed = 1;
 		}
 

base-commit: a8dfb2168906944ea61acfc87846b816eeab882d
-- 
2.34.1

Re: [PATCH RESEND] jfs: fix array-index-out-of-bounds read in add_missing_indices

Posted by Dave Kleikamp 10 months, 1 week ago

On 4/1/25 10:29AM, Aditya Dutt wrote:
> stbl is s8 but it must contain offsets into slot which can go from 0 to
> 127.
> 
> Added a bound check for that error and return -EIO if the check fails.
> Also make jfs_readdir return with error if add_missing_indices returns
> with an error.

Looks good. The only change I'm making is removing the jfs_err() call in 
the caller since the failing function is already spitting out an error 
message.

Thanks,
Shaggy

> 
> Reported-by: syzbot+b974bd41515f770c608b@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com./bug?extid=b974bd41515f770c608b
> Signed-off-by: Aditya Dutt <duttaditya18@gmail.com>
> ---
>   fs/jfs/jfs_dtree.c | 20 +++++++++++++++++---
>   1 file changed, 17 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
> index 93db6eec4465..de33026d18d2 100644
> --- a/fs/jfs/jfs_dtree.c
> +++ b/fs/jfs/jfs_dtree.c
> @@ -2613,7 +2613,7 @@ void dtInitRoot(tid_t tid, struct inode *ip, u32 idotdot)
>    *	     fsck.jfs should really fix this, but it currently does not.
>    *	     Called from jfs_readdir when bad index is detected.
>    */
> -static void add_missing_indices(struct inode *inode, s64 bn)
> +static int add_missing_indices(struct inode *inode, s64 bn)
>   {
>   	struct ldtentry *d;
>   	struct dt_lock *dtlck;
> @@ -2622,7 +2622,7 @@ static void add_missing_indices(struct inode *inode, s64 bn)
>   	struct lv *lv;
>   	struct metapage *mp;
>   	dtpage_t *p;
> -	int rc;
> +	int rc = 0;
>   	s8 *stbl;
>   	tid_t tid;
>   	struct tlock *tlck;
> @@ -2647,6 +2647,16 @@ static void add_missing_indices(struct inode *inode, s64 bn)
>   
>   	stbl = DT_GETSTBL(p);
>   	for (i = 0; i < p->header.nextindex; i++) {
> +		if (stbl[i] < 0) {
> +			jfs_err("jfs: add_missing_indices: Invalid stbl[%d] = %d for inode %ld, block = %lld",
> +				i, stbl[i], (long)inode->i_ino, (long long)bn);
> +			rc = -EIO;
> +
> +			DT_PUTPAGE(mp);
> +			txAbort(tid, 0);
> +			goto end;
> +		}
> +
>   		d = (struct ldtentry *) &p->slot[stbl[i]];
>   		index = le32_to_cpu(d->index);
>   		if ((index < 2) || (index >= JFS_IP(inode)->next_index)) {
> @@ -2664,6 +2674,7 @@ static void add_missing_indices(struct inode *inode, s64 bn)
>   	(void) txCommit(tid, 1, &inode, 0);
>   end:
>   	txEnd(tid);
> +	return rc;
>   }
>   
>   /*
> @@ -3017,7 +3028,10 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
>   		}
>   
>   		if (fix_page) {
> -			add_missing_indices(ip, bn);
> +			if ((rc = add_missing_indices(ip, bn))) {
> +				jfs_err("jfs_readdir: add_missing_indices returned %d", rc);
> +				goto out;
> +			}
>   			page_fixed = 1;
>   		}
>   
> 
> base-commit: a8dfb2168906944ea61acfc87846b816eeab882d