Forwarded: [PATCH] jfs: validate db_maxfreebud in extBalloc to prevent

[syzbot <syzbot+13e8cd4926977f8337b6@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] jfs: validate db_maxfreebud in extBalloc to prevent
Author: tristmd@gmail.com

From: Tristan Madani <tristan@talencesecurity.com>

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

 shift-out-of-bounds

extBalloc() computes the maximum allocation size using:

    max = (s64) 1 << bmp->db_maxfreebud;

where db_maxfreebud is an s8 read from the on-disk bmap structure.
A crafted JFS image can provide a value of 108, which exceeds the
maximum valid shift exponent for a 64-bit signed integer (63),
triggering a UBSAN shift-out-of-bounds error.

The value -1 is already handled as a sentinel for "no free space",
but no upper bound check exists.  Add a validation check to return
-EIO when db_maxfreebud contains an out-of-range value, indicating
on-disk corruption.

Reported-by: syzbot+13e8cd4926977f8337b6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=13e8cd4926977f8337b6
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/jfs/jfs_extent.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/jfs/jfs_extent.c b/fs/jfs/jfs_extent.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/jfs/jfs_extent.c
+++ b/fs/jfs/jfs_extent.c
@@ -326,6 +326,12 @@ extBalloc(struct inode *ip, s64 hint, s64 * nblocks, s64 * blkno)
 	if (bmp->db_maxfreebud == -1)
 		return -ENOSPC;

+	if (bmp->db_maxfreebud < 0 || bmp->db_maxfreebud > 63) {
+		jfs_error(ip->i_sb,
+			  "invalid db_maxfreebud: %d\n", bmp->db_maxfreebud);
+		return -EIO;
+	}
+
 	max = (s64) 1 << bmp->db_maxfreebud;
 	if (*nblocks >= max && *nblocks > nbperpage)
 		nb = nblks = (max > nbperpage) ? max : nbperpage;
--
2.43.0