For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] jfs: validate l2nbperiext in diMount() to prevent shift-out-of-bounds
Author: tristmd@gmail.com

From: Tristan Madani <tristan@talencesecurity.com>

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diMount() reads im_l2nbperiext and im_nbperiext directly from on-disk
metadata without validating them. A corrupted filesystem image can set
im_l2nbperiext to an arbitrarily large value, which is then used as a
shift exponent in jfs_statfs():

  maxinodes = min((s64) atomic_read(&imap->im_numinos) +
                  ((sbi->bmap->db_nfree >> imap->im_l2nbperiext)
                   << L2INOSPEREXT), (s64) 0xffffffffLL);

This triggers UBSAN shift-out-of-bounds when the exponent exceeds 63.

Add a sanity check after reading both fields in diMount() to reject
the filesystem mount if l2nbperiext is out of range or inconsistent
with nbperiext.

Reported-by: syzbot+13ba7f3e9a17f77250fe@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=13ba7f3e9a17f77250fe
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/jfs/jfs_imap.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -125,6 +125,17 @@ int diMount(struct inode *ipimap)
 	imap->im_nbperiext = le32_to_cpu(dinom_le->in_nbperiext);
 	imap->im_l2nbperiext = le32_to_cpu(dinom_le->in_l2nbperiext);
+
+	if (imap->im_l2nbperiext < 0 ||
+	    imap->im_l2nbperiext > 30 ||
+	    imap->im_nbperiext != (1 << imap->im_l2nbperiext)) {
+		jfs_err("diMount: invalid imap parameters: "
+			"nbperiext(%d) l2nbperiext(%d)",
+			imap->im_nbperiext, imap->im_l2nbperiext);
+		release_metapage(mp);
+		kfree(imap);
+		return -EINVAL;
+	}
+
 	for (index = 0; index < MAXAG; index++) {
 		imap->im_agctl[index].inofree =
 		    le32_to_cpu(dinom_le->in_agctl[index].inofree);
-- 
2.43.0