Messages in this thread Patch in this message | | | Date | Sat, 19 Mar 2022 21:23:06 +0300 | Subject | Re: [syzbot] divide error in dbNextAG | From | Pavel Skripkin <> |
| |
On 3/19/22 21:07, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: 09688c0166e7 Linux 5.17-rc8 > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=163e5015700000 > kernel config: https://syzkaller.appspot.com/x/.config?x=70f75a89c7a0e6bc > dashboard link: https://syzkaller.appspot.com/bug?extid=46f5c25af73eb8330eb6 > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=132c1d61700000 > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+46f5c25af73eb8330eb6@syzkaller.appspotmail.com > > divide error: 0000 [#1] PREEMPT SMP KASAN > CPU: 1 PID: 3622 Comm: syz-executor.0 Not tainted 5.17.0-rc8-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > RIP: 0010:dbNextAG+0xfc/0x5f0 fs/jfs/jfs_dmap.c:602
Looks like malicious fs image with bmp->db_numag == 0.
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
With regards, Pavel Skripkindiff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 91f4ec93dab1..633a9aff0868 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -148,6 +148,7 @@ static const s8 budtab[256] = { * 0 - success * -ENOMEM - insufficient memory * -EIO - i/o error + * -EINVAL - wrong bmap data */ int dbMount(struct inode *ipbmap) { @@ -179,6 +180,9 @@ int dbMount(struct inode *ipbmap) bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree); bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage); bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag); + if (!bmp->db_numag) + return -EINVAL; + bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel); bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag); bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref); | |