[PATCH] ufs: validate block and fragment shifts

[Matheus Alves de Almeida]

Currently, ufs_fill_super() accepts images with an fs_bshift and an
fs_fshift that do not match their respective size fields. This causes
UBSAN shift-out-of-bounds issues in the bad fs_bshift case and an
out-of-bounds read and kernel oops in the bad fs_fshift case.

Make the ufs_fill_super() function check that these fields agree with
their size counterparts.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+5585f47221c0de04168d@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=5585f47221c0de04168d
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Matheus Alves de Almeida <matheus.aalmeida@xxxxxxxxxxxx>
---
 fs/ufs/super.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index 3569ac92b..7df3eedd9 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -1001,7 +1001,10 @@ static int ufs_fill_super(struct super_block *sb, struct fs_context *fc)
 	uspi->s_fsize = fs32_to_cpu(sb, usb1->fs_fsize);
 	uspi->s_sbsize = fs32_to_cpu(sb, usb1->fs_sbsize);
 	uspi->s_fmask = fs32_to_cpu(sb, usb1->fs_fmask);
+	uspi->s_bshift = fs32_to_cpu(sb, usb1->fs_bshift);
 	uspi->s_fshift = fs32_to_cpu(sb, usb1->fs_fshift);
+	UFSD("uspi->s_bshift = %d,uspi->s_fshift = %d", uspi->s_bshift,
+		uspi->s_fshift);
 
 	if (!is_power_of_2(uspi->s_fsize)) {
 		pr_err("%s(): fragment size %u is not a power of 2\n",
@@ -1018,6 +1021,11 @@ static int ufs_fill_super(struct super_block *sb, struct fs_context *fc)
 		       __func__, uspi->s_fsize);
 		goto failed;
 	}
+	if (uspi->s_fshift != ilog2(uspi->s_fsize)) {
+		pr_err("%s(): fragment size shift %u does not match fragment size %u\n",
+		       __func__, uspi->s_fshift, uspi->s_fsize);
+		goto failed;
+	}
 	if (!is_power_of_2(uspi->s_bsize)) {
 		pr_err("%s(): block size %u is not a power of 2\n",
 		       __func__, uspi->s_bsize);
@@ -1028,6 +1036,11 @@ static int ufs_fill_super(struct super_block *sb, struct fs_context *fc)
 		       __func__, uspi->s_bsize);
 		goto failed;
 	}
+	if (uspi->s_bshift != ilog2(uspi->s_bsize)) {
+		pr_err("%s(): block size shift %u does not match block size %u\n",
+		       __func__, uspi->s_bshift, uspi->s_bsize);
+		goto failed;
+	}
 	if (uspi->s_bsize / uspi->s_fsize > 8) {
 		pr_err("%s(): too many fragments per block (%u)\n",
 		       __func__, uspi->s_bsize / uspi->s_fsize);
@@ -1117,10 +1130,6 @@ static int ufs_fill_super(struct super_block *sb, struct fs_context *fc)
 	uspi->s_minfree = fs32_to_cpu(sb, usb1->fs_minfree);
 	uspi->s_bmask = fs32_to_cpu(sb, usb1->fs_bmask);
 	uspi->s_fmask = fs32_to_cpu(sb, usb1->fs_fmask);
-	uspi->s_bshift = fs32_to_cpu(sb, usb1->fs_bshift);
-	uspi->s_fshift = fs32_to_cpu(sb, usb1->fs_fshift);
-	UFSD("uspi->s_bshift = %d,uspi->s_fshift = %d", uspi->s_bshift,
-		uspi->s_fshift);
 	uspi->s_fpbshift = fs32_to_cpu(sb, usb1->fs_fragshift);
 	uspi->s_fsbtodb = fs32_to_cpu(sb, usb1->fs_fsbtodb);
 	/* s_sbsize already set */
-- 
2.43.0