[PATCH 6.6.y] gfs2: Validate i_depth for exhash directories

[PATCH 6.6.y] gfs2: Validate i_depth for exhash directories

[driz2t]

[-- Attachment #1.1: Type: text/plain, Size: 194 bytes --]

Hi,

Please test this patch on stable 6.6.y.


#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git c09fbcd31ae6d71e7c69545839bec92d8e15c13b


Thanks,
Changjian Liu

[-- Attachment #1.2: Type: text/html, Size: 269 bytes --]

[-- Attachment #2: 469b584076b88cbb037d.patch --]
[-- Type: application/octet-stream, Size: 2656 bytes --]

commit 557c024ca7250bb65ae60f16c02074106c2f197b
Author: Andrew Price <anprice@redhat.com>
Date:   Wed Jul 16 14:12:07 2025 +0100

    gfs2: Validate i_depth for exhash directories
    
    A fuzzer test introduced corruption that ends up with a depth of 0 in
    dir_e_read(), causing an undefined shift by 32 at:
    
      index = hash >> (32 - dip->i_depth);
    
    As calculated in an open-coded way in dir_make_exhash(), the minimum
    depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is
    invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time.
    
    So we can avoid the undefined behaviour by checking for depth values
    lower than the minimum in gfs2_dinode_in(). Values greater than the
    maximum are already being checked for there.
    
    Also switch the calculation in dir_make_exhash() to use ilog2() to
    clarify how the depth is calculated.
    
    Tested with the syzkaller repro.c and xfstests '-g quick'.
    
    Reported-by: syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com
    Signed-off-by: Andrew Price <anprice@redhat.com>
    Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -60,6 +60,7 @@
 #include <linux/crc32.h>
 #include <linux/vmalloc.h>
 #include <linux/bio.h>
+#include <linux/log2.h>
 
 #include "gfs2.h"
 #include "incore.h"
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -912,7 +913,6 @@ static int dir_make_exhash(struct inode *inode)
 	struct qstr args;
 	struct buffer_head *bh, *dibh;
 	struct gfs2_leaf *leaf;
-	int y;
 	u32 x;
 	__be64 *lp;
 	u64 bn;
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -979,9 +979,7 @@ static int dir_make_exhash(struct inode *inode)
 	i_size_write(inode, sdp->sd_sb.sb_bsize / 2);
 	gfs2_add_inode_blocks(&dip->i_inode, 1);
 	dip->i_diskflags |= GFS2_DIF_EXHASH;
-
-	for (x = sdp->sd_hash_ptrs, y = -1; x; x >>= 1, y++) ;
-	dip->i_depth = y;
+	dip->i_depth = ilog2(sdp->sd_hash_ptrs);
 
 	gfs2_dinode_out(dip, dibh->b_data);
 
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -11,6 +11,7 @@
 #include <linux/bio.h>
 #include <linux/posix_acl.h>
 #include <linux/security.h>
+#include <linux/log2.h>
 
 #include "gfs2.h"
 #include "incore.h"
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -460,8 +460,13 @@
 	if (unlikely(depth > GFS2_DIR_MAX_DEPTH))
 		goto corrupt;
 	ip->i_depth = (u8)depth;
+    if ((ip->i_diskflags & GFS2_DIF_EXHASH) &&
+        depth < ilog2(sdp->sd_hash_ptrs)) {
+        gfs2_consist_inode(ip);
+        return -EIO;
+    }
 	ip->i_entries = be32_to_cpu(str->di_entries);
 
 	if (gfs2_is_stuffed(ip) && inode->i_size > gfs2_max_stuffed_size(ip))
 		goto corrupt;
 

Re: [v6.6] KASAN: slab-use-after-free Write in gfs2_qd_dealloc

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+469b584076b88cbb037d@syzkaller.appspotmail.com
Tested-by: syzbot+469b584076b88cbb037d@syzkaller.appspotmail.com

Tested on:

commit:         c09fbcd3 Linux 6.6.130
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=162b8ef6580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=cf30d9e358c58220
dashboard link: https://syzkaller.appspot.com/bug?extid=469b584076b88cbb037d
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10966f72580000

Note: testing is done by a robot and is best-effort only.