Re: [Jfs-discussion] UBSAN: shift-out-of-bounds in extAlloc

[Dave Kleikamp]

On 9/12/23 6:03PM, Sanan Hasanov via Jfs-discussion wrote:
> Good day, dear maintainers,
>
> We found a bug using a modified kernel configuration file used by syzbot.
>
> We enhanced the coverage of the configuration file using our tool, klocalizer.
>
> Kernel Branch: 6.3.0-next-20230426
> Kernel Config: https://drive.google.com/file/d/1v6xpOJVgzbn78LEAq5eX9bZiPJPqhfZf/view?usp=sharing
> Reproducer: https://drive.google.com/file/d/1-HrYhFL6t4xZ-fRhqo9yswIFG3Sk1FoV/view?usp=sharing
> Thank you!

This is likely fixed with the recent commit:
0225e10972fa ("jfs: validate max amount of blocks before allocation.")
This is first present in v6.6-rc1

Shaggy

> Best regards,
> Sanan Hasanov
>
> ================================================================================
> UBSAN: shift-out-of-bounds in fs/jfs/jfs_extent.c:314:16
> shift exponent -1 is negative
> CPU: 2 PID: 23961 Comm: syz-executor.1 Not tainted 6.3.0-next-20230426 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Call Trace:
>   <TASK>
>   __dump_stack lib/dump_stack.c:88 [inline]
>   dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106
>   ubsan_epilogue lib/ubsan.c:217 [inline]
>   __ubsan_handle_shift_out_of_bounds+0x21f/0x5a0 lib/ubsan.c:387
>   extBalloc fs/jfs/jfs_extent.c:314 [inline]
>   extAlloc.cold+0x8d/0x92 fs/jfs/jfs_extent.c:122
>   jfs_get_block+0x662/0xa90 fs/jfs/inode.c:248
>   __block_write_begin_int+0x3bd/0x14b0 fs/buffer.c:2064
>   __block_write_begin fs/buffer.c:2114 [inline]
>   block_write_begin+0xb9/0x4d0 fs/buffer.c:2175
>   jfs_write_begin+0x31/0xd0 fs/jfs/inode.c:299
>   generic_perform_write+0x259/0x580 mm/filemap.c:3923
>   __generic_file_write_iter+0x2ae/0x500 mm/filemap.c:4051
>   generic_file_write_iter+0xe3/0x350 mm/filemap.c:4083
>   __kernel_write_iter+0x262/0x7a0 fs/read_write.c:517
>   dump_emit_page fs/coredump.c:886 [inline]
>   dump_user_range+0x23c/0x710 fs/coredump.c:913
>   elf_core_dump+0x2786/0x36e0 fs/binfmt_elf.c:2142
>   do_coredump+0x2ed8/0x3fd0 fs/coredump.c:762
>   get_signal+0x1c11/0x25c0 kernel/signal.c:2860
>   arch_do_signal_or_restart+0x79/0x5a0 arch/x86/kernel/signal.c:307
>   exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
>   exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
>   irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:310
>   exc_page_fault+0xc4/0x180 arch/x86/mm/fault.c:1615
>   asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
> RIP: 0033:0x9800
> Code: Unable to access opcode bytes at 0x97d6.
> RSP: 002b:0000000020000248 EFLAGS: 00010217
> RAX: 0000000000000000 RBX: 00007f7356dbbf80 RCX: 00007f7356c8edcd
> RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000000
> RBP: 00007f7356cfc59c R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fffbb79ec8f R14: 00007fffbb79ee30 R15: 00007f7357ecbd80
>   </TASK>
> ================================================================================
>
>
> _______________________________________________
> Jfs-discussion mailing list
> Jfs-discussion@xxxxxxxxxxxxxxxxxxxxx
> https://lists.sourceforge.net/lists/listinfo/jfs-discussion