[PATCH] gfs2: capture blocksize set failed
From: Edward Adam Davis
Date: Sat Apr 12 2025 - 01:07:51 EST
syzbot reported a oob in gfs2_fill_super. [1]
When setting blocksize fails, the s_blocksize_bits value is incorrect.
[1]
UBSAN: shift-out-of-bounds in fs/gfs2/ops_fstype.c:1172:19
shift exponent 4294967287 is too large for 64-bit type 'unsigned long'
CPU: 1 UID: 0 PID: 6127 Comm: syz.0.42 Not tainted 6.14.0-next-20250404-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
ubsan_epilogue lib/ubsan.c:231 [inline]
__ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:492
gfs2_fill_super+0x255e/0x27b0 fs/gfs2/ops_fstype.c:1172
get_tree_bdev_flags+0x490/0x5c0 fs/super.c:1636
gfs2_get_tree+0x54/0x220 fs/gfs2/ops_fstype.c:1330
vfs_get_tree+0x90/0x2b0 fs/super.c:1759
do_new_mount+0x2cf/0xb70 fs/namespace.c:3879
do_mount fs/namespace.c:4219 [inline]
__do_sys_mount fs/namespace.c:4430 [inline]
__se_sys_mount+0x38c/0x400 fs/namespace.c:4407
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Reported-by: syzbot+b0018b7468b2af33b4d5@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Edward Adam Davis <eadavis@xxxxxx>
---
fs/gfs2/ops_fstype.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index e83d293c3614..d5bc25164b89 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1167,6 +1167,10 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
/* Set up the buffer cache and fill in some fake block size values
to allow us to read-in the on-disk superblock. */
sdp->sd_sb.sb_bsize = sb_min_blocksize(sb, 512);
+ if (!sdp->sd_sb.sb_bsize) {
+ error = -EINVAL;
+ goto fail_free;
+ }
sdp->sd_sb.sb_bsize_shift = sb->s_blocksize_bits;
sdp->sd_fsb2bb_shift = sdp->sd_sb.sb_bsize_shift - 9;
sdp->sd_fsb2bb = BIT(sdp->sd_fsb2bb_shift);
--
2.43.0