[PATCH] fs: f2fs: fix potential shift-out-of-bounds error in sanity_check_raw_super()

[PATCH] fs: f2fs: fix potential shift-out-of-bounds error in sanity_check_raw_super()

[Anant Thazhemadam]

In sanity_check_raw_super(), if
1 << le32_to_cpu(raw_super->log_blocksize) != F2FS_BLKSIZE, then the
block size is deemed to be invalid.

syzbot triggered a shift-out-of-bounds bug by assigning a value of 59 to
le32_to_cpu(raw_super->log_blocksize).
Although the value assigned itself isn't of much significance, this goes
to show that even if the block size is invalid,
le32_to_cpu(raw_super->log_blocksize) can be potentially evaluated to a
value for which the shift exponent becomes too large for the unsigned
int.

Since 1 << le32_to_cpu(raw_super->log_blocksize) must be = 4096 for a
valid block size, le32_to_cpu(raw_super->log_blocksize) must equal 12.
Replacing the existing check with the more direct sanity check
resolves this bug.

Reported-by: syzbot+ca9a785f8ac472085994@syzkaller.appspotmail.com
Tested-by: syzbot+ca9a785f8ac472085994@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
---
 fs/f2fs/super.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 33808c397580..4bc7372af43f 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -2775,7 +2775,6 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
 	block_t total_sections, blocks_per_seg;
 	struct f2fs_super_block *raw_super = (struct f2fs_super_block *)
 					(bh->b_data + F2FS_SUPER_OFFSET);
-	unsigned int blocksize;
 	size_t crc_offset = 0;
 	__u32 crc = 0;
 
@@ -2802,10 +2801,8 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
 	}
 
 	/* Currently, support only 4KB block size */
-	blocksize = 1 << le32_to_cpu(raw_super->log_blocksize);
-	if (blocksize != F2FS_BLKSIZE) {
-		f2fs_info(sbi, "Invalid blocksize (%u), supports only 4KB",
-			  blocksize);
+	if (le32_to_cpu(raw_super->log_blocksize) != 12) {
+		f2fs_info(sbi, "Invalid blocksize. Only 4KB supported");
 		return -EFSCORRUPTED;
 	}
 
-- 
2.25.1

Re: [f2fs-dev] [PATCH] fs: f2fs: fix potential shift-out-of-bounds error in sanity_check_raw_super()

[Chao Yu]

Hi Anant,

I've posted a patch a little earlier. :P

https://lore.kernel.org/linux-f2fs-devel/20201209084936.31711-1-yuchao0@huawei.com/T/#u

Thanks,

On 2020/12/10 2:13, Anant Thazhemadam wrote:
> In sanity_check_raw_super(), if
> 1 << le32_to_cpu(raw_super->log_blocksize) != F2FS_BLKSIZE, then the
> block size is deemed to be invalid.
> 
> syzbot triggered a shift-out-of-bounds bug by assigning a value of 59 to
> le32_to_cpu(raw_super->log_blocksize).
> Although the value assigned itself isn't of much significance, this goes
> to show that even if the block size is invalid,
> le32_to_cpu(raw_super->log_blocksize) can be potentially evaluated to a
> value for which the shift exponent becomes too large for the unsigned
> int.
> 
> Since 1 << le32_to_cpu(raw_super->log_blocksize) must be = 4096 for a
> valid block size, le32_to_cpu(raw_super->log_blocksize) must equal 12.
> Replacing the existing check with the more direct sanity check
> resolves this bug.
> 
> Reported-by: syzbot+ca9a785f8ac472085994@syzkaller.appspotmail.com
> Tested-by: syzbot+ca9a785f8ac472085994@syzkaller.appspotmail.com
> Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
> ---
>   fs/f2fs/super.c | 7 ++-----
>   1 file changed, 2 insertions(+), 5 deletions(-)
> 
> diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
> index 33808c397580..4bc7372af43f 100644
> --- a/fs/f2fs/super.c
> +++ b/fs/f2fs/super.c
> @@ -2775,7 +2775,6 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
>   	block_t total_sections, blocks_per_seg;
>   	struct f2fs_super_block *raw_super = (struct f2fs_super_block *)
>   					(bh->b_data + F2FS_SUPER_OFFSET);
> -	unsigned int blocksize;
>   	size_t crc_offset = 0;
>   	__u32 crc = 0;
>   
> @@ -2802,10 +2801,8 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
>   	}
>   
>   	/* Currently, support only 4KB block size */
> -	blocksize = 1 << le32_to_cpu(raw_super->log_blocksize);
> -	if (blocksize != F2FS_BLKSIZE) {
> -		f2fs_info(sbi, "Invalid blocksize (%u), supports only 4KB",
> -			  blocksize);
> +	if (le32_to_cpu(raw_super->log_blocksize) != 12) {
> +		f2fs_info(sbi, "Invalid blocksize. Only 4KB supported");
>   		return -EFSCORRUPTED;
>   	}
>   
> 

Re: [f2fs-dev] [PATCH] fs: f2fs: fix potential shift-out-of-bounds error in sanity_check_raw_super()

[Anant Thazhemadam]

On 10/12/20 7:16 am, Chao Yu wrote:
> Hi Anant,
>
> I've posted a patch a little earlier. :P
>
> https://lore.kernel.org/linux-f2fs-devel/20201209084936.31711-1-yuchao0@huawei.com/T/#u
>
Ah well, that's alright, especially considering that your patch looks better.
Glad that bug has been fixed nonetheless. :)

Cheers,
Anant

Re: [f2fs-dev] [PATCH] fs: f2fs: fix potential shift-out-of-bounds error in sanity_check_raw_super()

[Chao Yu]

On 2020/12/10 10:00, Anant Thazhemadam wrote:
> 
> On 10/12/20 7:16 am, Chao Yu wrote:
>> Hi Anant,
>>
>> I've posted a patch a little earlier. :P
>>
>> https://lore.kernel.org/linux-f2fs-devel/20201209084936.31711-1-yuchao0@huawei.com/T/#u
>>
> Ah well, that's alright, especially considering that your patch looks better.
> Glad that bug has been fixed nonetheless. :)

Anyway, thanks a lot for taking time to fix f2fs bug. :)

I prefer to add your Signed-off-by into "f2fs: fix shift-out-of-bounds
in sanity_check_raw_super()" if you don't mind.

Thanks,

> 
> Cheers,
> Anant
> .
> 

Re: [f2fs-dev] [PATCH] fs: f2fs: fix potential shift-out-of-bounds error in sanity_check_raw_super()

[Anant Thazhemadam]

On 10/12/20 7:40 am, Chao Yu wrote:
> On 2020/12/10 10:00, Anant Thazhemadam wrote:
>>
>> On 10/12/20 7:16 am, Chao Yu wrote:
>>> Hi Anant,
>>>
>>> I've posted a patch a little earlier. :P
>>>
>>> https://lore.kernel.org/linux-f2fs-devel/20201209084936.31711-1-yuchao0@huawei.com/T/#u
>>>
>> Ah well, that's alright, especially considering that your patch looks better.
>> Glad that bug has been fixed nonetheless. :)
>
> Anyway, thanks a lot for taking time to fix f2fs bug. :)
>
> I prefer to add your Signed-off-by into "f2fs: fix shift-out-of-bounds
> in sanity_check_raw_super()" if you don't mind.
>
>

Sure, I'd appreciate that. Thank you! :D

Thanks,
Anant

Re: [f2fs-dev] [PATCH] fs: f2fs: fix potential shift-out-of-bounds error in sanity_check_raw_super()

[Chao Yu]

Jaegeuk,

Could you please help to add signed-off of Anant manually in

f2fs: fix shift-out-of-bounds in sanity_check_raw_super()

Thanks,

On 2020/12/10 10:14, Anant Thazhemadam wrote:
> 
> On 10/12/20 7:40 am, Chao Yu wrote:
>> On 2020/12/10 10:00, Anant Thazhemadam wrote:
>>>
>>> On 10/12/20 7:16 am, Chao Yu wrote:
>>>> Hi Anant,
>>>>
>>>> I've posted a patch a little earlier. :P
>>>>
>>>> https://lore.kernel.org/linux-f2fs-devel/20201209084936.31711-1-yuchao0@huawei.com/T/#u
>>>>
>>> Ah well, that's alright, especially considering that your patch looks better.
>>> Glad that bug has been fixed nonetheless. :)
>>
>> Anyway, thanks a lot for taking time to fix f2fs bug. :)
>>
>> I prefer to add your Signed-off-by into "f2fs: fix shift-out-of-bounds
>> in sanity_check_raw_super()" if you don't mind.
>>
>>
> 
> Sure, I'd appreciate that. Thank you! :D
> 
> Thanks,
> Anant
> 
> .
> 

Re: [f2fs-dev] [PATCH] fs: f2fs: fix potential shift-out-of-bounds error in sanity_check_raw_super()

[Jaegeuk Kim]

On 12/10, Chao Yu wrote:
> Jaegeuk,
> 
> Could you please help to add signed-off of Anant manually in
> 
> f2fs: fix shift-out-of-bounds in sanity_check_raw_super()

Done. Thank you guys. :)

> 
> Thanks,
> 
> On 2020/12/10 10:14, Anant Thazhemadam wrote:
> > 
> > On 10/12/20 7:40 am, Chao Yu wrote:
> > > On 2020/12/10 10:00, Anant Thazhemadam wrote:
> > > > 
> > > > On 10/12/20 7:16 am, Chao Yu wrote:
> > > > > Hi Anant,
> > > > > 
> > > > > I've posted a patch a little earlier. :P
> > > > > 
> > > > > https://lore.kernel.org/linux-f2fs-devel/20201209084936.31711-1-yuchao0@huawei.com/T/#u
> > > > > 
> > > > Ah well, that's alright, especially considering that your patch looks better.
> > > > Glad that bug has been fixed nonetheless. :)
> > > 
> > > Anyway, thanks a lot for taking time to fix f2fs bug. :)
> > > 
> > > I prefer to add your Signed-off-by into "f2fs: fix shift-out-of-bounds
> > > in sanity_check_raw_super()" if you don't mind.
> > > 
> > > 
> > 
> > Sure, I'd appreciate that. Thank you! :D
> > 
> > Thanks,
> > Anant
> > 
> > .
> >