From patchwork Wed Oct 19 09:38:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hoi Pok Wu X-Patchwork-Id: 5428 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp319426wrs; Wed, 19 Oct 2022 06:12:58 -0700 (PDT) X-Google-Smtp-Source: AMsMyM4YFHwyUzG2S6PjUQwZW/ZzalsUhcAFcA8YFqup3RSIqzw2FoPxgSSonOoxzgv/sIYfamTi X-Received: by 2002:a17:907:3e87:b0:78d:bb06:9066 with SMTP id hs7-20020a1709073e8700b0078dbb069066mr6661042ejc.387.1666185178200; Wed, 19 Oct 2022 06:12:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666185178; cv=none; d=google.com; s=arc-20160816; b=aobC2o1Izr7gzFPH9XdtZHHFuwETrFwWGELCUTx/Q5/a7l5ebjzkK1awvTiBKw64Dg H93fmcyeZHyYLODMjPXjHM+I/w7RLJhrGx87ZaXXhgVgy/I8xD3k7Eb8fZ75cqru4cOm PpAk57DzMdQDIFuPQ2ZrpAiL3An2TF4M01oqk3s8KPR+xu6obIRS2p8x17nLMAxQAT8K HI7GOP+wsi8URv6mCQWrUJsPMw4xUvJZbF7N5DB2q1AmMYqbEur6OCRjK0LUBLu1RyxV Ty/6K7CTs6Tl85YTIcU/QI7hIeVwd2MbCD1DL097IdJHTMrRwXk3i8zqRRfXMu6iw0Lp Up/w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=f59RIjGEwqOu67ef5ZU0jIO2IA5PQ6Gm9Ueoact0TG8=; b=Kn52jnK874T3ftw+HorZnqVmo8PldnNlNAL5nDHkGQOA/a5zvy2RZDC5lhGllw/oYM zeLaqTYTr5amSaREA1RVLK2XMBlCKEFtxlSg6QsBHH7pRdIxXmLoorsLkWkdikxDdeOG 6dR+7GQ2oeGnRciDxbqWPU/kUex6i0sQvIceoUtI0W8wWi/Nbe06V/p3UorVFlbiS1kz 4LEFFVPfaKeC7m1Hk4F6cOOOFqjDHBqk0l47BApEReb0MHSB80+0qJlDME2GmAQlj117 1ZVq1oDIAlqBdZB2u+lj5GBkZTAGcWVHzP48dDrYgbmC37N2BoWvZDfO52VWq8RK0yYI 4M0w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=bqRSRL8H; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id qf38-20020a1709077f2600b007823754ecd5si15549963ejc.43.2022.10.19.06.12.15; Wed, 19 Oct 2022 06:12:58 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=bqRSRL8H; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232386AbiJSNKY (ORCPT + 99 others); Wed, 19 Oct 2022 09:10:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51282 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232404AbiJSNJj (ORCPT ); Wed, 19 Oct 2022 09:09:39 -0400 Received: from mail-oi1-f180.google.com (mail-oi1-f180.google.com [209.85.167.180]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1B0514B0F9 for ; Wed, 19 Oct 2022 05:54:48 -0700 (PDT) Received: by mail-oi1-f180.google.com with SMTP id y72so19115028oia.3 for ; Wed, 19 Oct 2022 05:54:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=f59RIjGEwqOu67ef5ZU0jIO2IA5PQ6Gm9Ueoact0TG8=; b=bqRSRL8HLb+wNogKF5itSZhUrrM00dqcwkhn9W8gNWQ5In1LjWHJBmXjih9KVRyhmc Z5rm6JOPGNPHS9abKoxzZbhqKkuG1dS8MNCtVnKd/GoVhGxSifgIesc4J/egfw2wJKVu 1mInCg2QGiFfYqSLu9eNlLFGztmcL+GWQi+Zw9ggWl39E0SVLgyYmtqrWGu15DOdgvae YMTOq0uPIgVyWINb7OzW+Y6Js13TiFMH5UBzO4NDLfJ2XjBsXkkdQnS2eVNhWpXICBrb V7MEOJ7ufOxgmuw6GDfnW86xizprbpGa/FHGBBp2FGuRZjGl55kambcgx1aVQTRrAAGb K5+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=f59RIjGEwqOu67ef5ZU0jIO2IA5PQ6Gm9Ueoact0TG8=; b=cEl5i0WU+1vIadmRu61jYCtV6JzFNVEjuJyT7NKp7UIYXlEQ3F/6VWPS+ibkCpTwnr KWtYwazP1r3/h+Woo0WssB1EfJtzXuYMt1il2jLAua7Hhg1Ngv7umArNHZsw+MIbsfN9 7aDpWjraDuHK9XDqvtGJFp/mMrNn01uE49B44rp8Ib9x38+STlj9EMes5gqb7V7C1NbR ntPab8QnS2IJezFEIDHvtgXmTBs8mbI2YriTlDsG+wMflhYPhzki/isHwnGbIZF849Bf nUIc9rCGVV7kx0xSGLw4axNjDQDyxLzHpewEhds5SQ+sPeQJMR4RTdPdXfWeTZ4bVPBv VZAg== X-Gm-Message-State: ACrzQf0DdHhIRLAttG03U42mTstYaKdVQxoeincAz7hELrbEDD7Pxr7b vKWk77nHrGoey8pGCs8X6wLgiA0xkrQ= X-Received: by 2002:a17:90b:1c0e:b0:20d:8cc5:23e5 with SMTP id oc14-20020a17090b1c0e00b0020d8cc523e5mr8888517pjb.111.1666172387052; Wed, 19 Oct 2022 02:39:47 -0700 (PDT) Received: from localhost.localdomain (124244014158.ctinets.com. [124.244.14.158]) by smtp.gmail.com with ESMTPSA id y184-20020a6232c1000000b00562cfc80864sm10895192pfy.36.2022.10.19.02.39.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Oct 2022 02:39:46 -0700 (PDT) From: Hoi Pok Wu To: shaggy@kernel.org Cc: Hoi Pok Wu , jfs-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org, syzbot+f0e0fcf3cd1047ae60ad@syzkaller.appspotmail.com, syzkaller-bugs@googlegroups.com Subject: [PATCH] fs: jfs: fix shift-out-of-bounds in dbDiscardAG Date: Wed, 19 Oct 2022 17:38:25 +0800 Message-Id: <20221019093825.339991-1-wuhoipok@gmail.com> X-Mailer: git-send-email 2.38.0 MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747121789455293227?= X-GMAIL-MSGID: =?utf-8?q?1747121789455293227?= Bug reported by syzbot, UBSAN: array-index-out-of-bounds in dbDiscardAG. Fixed by simply rearranging agno_end smaller than MAXAG. However, I wonder if it is a better idea to return -EINVAL, rejecting user input. Thank you. Reported-by: syzbot+f0e0fcf3cd1047ae60ad@syzkaller.appspotmail.com Signed-off-by: Hoi Pok Wu --- fs/jfs/jfs_discard.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/jfs/jfs_discard.c b/fs/jfs/jfs_discard.c index 575cb2ba74fc..3101eaf3098a 100644 --- a/fs/jfs/jfs_discard.c +++ b/fs/jfs/jfs_discard.c @@ -96,6 +96,10 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range) */ agno = BLKTOAG(start, JFS_SBI(ip->i_sb)); agno_end = BLKTOAG(end, JFS_SBI(ip->i_sb)); + + if (agno_end >= MAXAG) + agno_end = MAXAG - 1; + while (agno <= agno_end) { trimmed += dbDiscardAG(ip, agno, minlen); agno++;