Re: [syzbot] Re: general protection fault in jfs_error()

From: syzbot
Date: Tue Nov 19 2024 - 01:24:48 EST


For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: Re: general protection fault in jfs_error()
Author: dmantipov@xxxxxxxxx

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 158f238aa69d91ad74e535c73f552bd4b025109c

diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
index 98f9a432c336..c0a51defc5b7 100644
--- a/fs/jfs/jfs_mount.c
+++ b/fs/jfs/jfs_mount.c
@@ -303,12 +303,6 @@ static int chkSuper(struct super_block *sb)
/*
* validate superblock
*/
- /* validate fs signature */
- if (strncmp(j_sb->s_magic, JFS_MAGIC, 4) ||
- le32_to_cpu(j_sb->s_version) > JFS_VERSION) {
- rc = -EINVAL;
- goto out;
- }

bsize = le32_to_cpu(j_sb->s_bsize);
if (bsize != PSIZE) {
@@ -449,6 +443,18 @@ int updateSuper(struct super_block *sb, uint state)
return 0;
}

+static int validateSuper(struct buffer_head *bh)
+{
+ struct jfs_superblock *j_sb;
+
+ if (!bh)
+ return -EIO;
+
+ j_sb = (struct jfs_superblock *)bh->b_data;
+
+ return (strncmp(j_sb->s_magic, JFS_MAGIC, 4) == 0 &&
+ le32_to_cpu(j_sb->s_version) <= JFS_VERSION) ? 0 : -EINVAL;
+}

/*
* readSuper()
@@ -457,17 +463,17 @@ int updateSuper(struct super_block *sb, uint state)
*/
int readSuper(struct super_block *sb, struct buffer_head **bpp)
{
- /* read in primary superblock */
+ /* read in and validate primary superblock */
*bpp = sb_bread(sb, SUPER1_OFF >> sb->s_blocksize_bits);
- if (*bpp)
+ if (!validateSuper(*bpp))
return 0;

- /* read in secondary/replicated superblock */
+ /* read in and validate secondary/replicated superblock */
*bpp = sb_bread(sb, SUPER2_OFF >> sb->s_blocksize_bits);
- if (*bpp)
+ if (!validateSuper(*bpp))
return 0;

- return -EIO;
+ return -EINVAL;
}


diff --git a/fs/jfs/jfs_umount.c b/fs/jfs/jfs_umount.c
index 8ec43f53f686..5f01f767bc0a 100644
--- a/fs/jfs/jfs_umount.c
+++ b/fs/jfs/jfs_umount.c
@@ -104,14 +104,15 @@ int jfs_umount(struct super_block *sb)
* list (to signify skip logredo()).
*/
if (log) { /* log = NULL if read-only mount */
- updateSuper(sb, FM_CLEAN);
-
- /*
- * close log:
- *
- * remove file system from log active file system list.
- */
- rc = lmLogClose(sb);
+ rc = updateSuper(sb, FM_CLEAN);
+ if (!rc) {
+ /*
+ * close log:
+ *
+ * remove file system from log active file system list.
+ */
+ rc = lmLogClose(sb);
+ }
}
jfs_info("UnMount JFS Complete: rc = %d", rc);
return rc;
@@ -122,6 +123,7 @@ int jfs_umount_rw(struct super_block *sb)
{
struct jfs_sb_info *sbi = JFS_SBI(sb);
struct jfs_log *log = sbi->log;
+ int rc;

if (!log)
return 0;
@@ -147,7 +149,7 @@ int jfs_umount_rw(struct super_block *sb)
*/
filemap_write_and_wait(sbi->direct_inode->i_mapping);

- updateSuper(sb, FM_CLEAN);
+ rc = updateSuper(sb, FM_CLEAN);

- return lmLogClose(sb);
+ return rc ? rc : lmLogClose(sb);
}