public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] jfs: fix slab-out-of-bounds Read in dtSearch
@ 2023-10-16 17:11 Manas Ghandat
  2023-10-24 10:46 ` Dan Carpenter
  2023-10-24 12:00 ` kernel test robot
  0 siblings, 2 replies; 4+ messages in thread
From: Manas Ghandat @ 2023-10-16 17:11 UTC (permalink / raw)
  To: dave.kleikamp, shaggy
  Cc: Manas Ghandat, Linux-kernel-mentees, jfs-discussion, linux-kernel,
	syzbot+9924e2a08d9ba0fd4ce2

Currently while searching for current page in the sorted entry table
of the page there is a out of bound access. Added a bound check to fix
the error.

Reported-by: syzbot+9924e2a08d9ba0fd4ce2@syzkaller.appspotmail.com
Fixes: https://syzkaller.appspot.com/bug?extid=9924e2a08d9ba0fd4ce2
Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
---
 fs/jfs/jfs_dtree.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 92b7c533407c..cf67d32d5b7f 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -633,6 +633,9 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
 		for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) {
 			index = base + (lim >> 1);
 
+			if (stbl[index] > 128 || stbl[index] < 0)
+				goto out;
+
 			if (p->header.flag & BT_LEAF) {
 				/* uppercase leaf name to compare */
 				cmp =
-- 
2.37.2


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* [PATCH] jfs: fix slab-out-of-bounds read in dtSearch
@ 2026-01-12 12:22 Vadim Havkin
  0 siblings, 0 replies; 4+ messages in thread
From: Vadim Havkin @ 2026-01-12 12:22 UTC (permalink / raw)
  To: shaggy; +Cc: jfs-discussion, linux-kernel, lvc-project

Syzkaller reported a slab-out-of-bounds read in dtSearch. This occurs
when the driver attempts to access the slot array using an index read
from the stbl (sorted table) without validation.

When working with an inline directory (bn == 0), the p pointer refers
to the dtroot_t structure embedded in jfs_inode_info. This buffer can
hold DTROOTMAXSLOT slots. However, the pointer is cast to (dtpage_t *),
which corresponds to a full page (DTPAGEMAXSLOT slots). If a corrupted
image contains an index in stbl greater than or equal to DTROOTMAXSLOT,
the driver calculates an address outside the allocated slab object.

BUG: KASAN: slab-out-of-bounds in dtSearch+0x21fd/0x2270 fs/jfs/jfs_dtree.c:645
Read of size 1 at addr ffff88810d94b5d4 by task syz-executor107/859
Call Trace:
 <TASK>
 kasan_report+0xb9/0xf0
 dtSearch+0x21fd/0x2270
 jfs_lookup+0x180/0x340
 lookup_open.isra.0+0x7a7/0x1430
 path_openat+0xcc0/0x2960
 do_filp_open+0x1c3/0x410
 do_sys_openat2+0x164/0x1d0
 __x64_sys_openat+0x13c/0x1f0
 </TASK>

Add a check to ensure that the index read from stbl is valid.
For the inline root (bn == 0), the index must be strictly less than
DTROOTMAXSLOT. Note that stbl values are type s8, so they cannot
exceed the external page limit (DTPAGEMAXSLOT = 128).

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Vadim Havkin <xqzmiplz@yandex.ru>
---
 fs/jfs/jfs_dtree.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 93db6eec4465..d2bdadaf4672 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -634,7 +634,8 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
 		for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) {
 			index = base + (lim >> 1);
 
-			if (stbl[index] < 0) {
+			if (stbl[index] < 0 ||
+			    (bn == 0 && stbl[index] >= DTROOTMAXSLOT)) {
 				rc = -EIO;
 				goto out;
 			}
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-01-12 12:22 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-10-16 17:11 [PATCH] jfs: fix slab-out-of-bounds Read in dtSearch Manas Ghandat
2023-10-24 10:46 ` Dan Carpenter
2023-10-24 12:00 ` kernel test robot
  -- strict thread matches above, loose matches on Subject: below --
2026-01-12 12:22 [PATCH] jfs: fix slab-out-of-bounds read " Vadim Havkin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox