Messages in this thread Patch in this message | | | Date | Mon, 24 Oct 2022 16:05:30 -0500 | Subject | Re: [PATCH] fs: jfs: fix shift-out-of-bounds in dbDiscardAG | From | Dave Kleikamp <> |
| |
On 10/19/22 4:38AM, Hoi Pok Wu wrote: > Bug reported by syzbot, UBSAN: array-index-out-of-bounds in dbDiscardAG. > Fixed by simply rearranging agno_end smaller than MAXAG. However, I wonder if it > is a better idea to return -EINVAL, rejecting user input. Thank you.
I don't think the problem is simply that the user input is bad, the range is already limited:
if (end >= bmp->db_mapsize) end = bmp->db_mapsize - 1;
It seems syzbot corrupted some on-disk data structure to trigger this failure. It may be best to call jfs_error() and bail out.
Thanks, Shaggy
> > Reported-by: syzbot+f0e0fcf3cd1047ae60ad@syzkaller.appspotmail.com > Signed-off-by: Hoi Pok Wu <wuhoipok@gmail.com> > --- > fs/jfs/jfs_discard.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/fs/jfs/jfs_discard.c b/fs/jfs/jfs_discard.c > index 575cb2ba74fc..3101eaf3098a 100644 > --- a/fs/jfs/jfs_discard.c > +++ b/fs/jfs/jfs_discard.c > @@ -96,6 +96,10 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range) > */ > agno = BLKTOAG(start, JFS_SBI(ip->i_sb)); > agno_end = BLKTOAG(end, JFS_SBI(ip->i_sb)); > + > + if (agno_end >= MAXAG) > + agno_end = MAXAG - 1; > + > while (agno <= agno_end) { > trimmed += dbDiscardAG(ip, agno, minlen); > agno++;
| |