Re: [PATCH] ufs: validate cylinder group free bitmap offset

Next message: SJ Park: "[PATCH 05/12] mm/damon/sysfs: remove probes number validation"
Previous message: SJ Park: "[PATCH 04/12] mm/damon/core: validate number of probes in valid_probe_params()"
In reply to: Cen Zhang (Microsoft Security FORGE Labs): "[PATCH] ufs: validate cylinder group free bitmap offset"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

From: Greg KH

Date: Wed Sep 02 2026 - 01:53:42 EST

On Tue, Sep 01, 2026 at 02:06:00PM -0400, Cen Zhang (Microsoft Security FORGE Labs) wrote:
> ufs_read_cylinder() copies cg_freeoff from the on-disk cylinder group
> without checking that the free-fragment bitmap fits in the loaded
> cylinder group buffers. A crafted image can place cg_freeoff past those
> buffers so that allocation later indexes ubh->bh[] out of range.
>
> UBSAN: array-index-out-of-bounds in fs/ufs/balloc.c:752:15
> ubh_scanc() fs/ufs/balloc.c:752
> ufs_bitmap_search() fs/ufs/balloc.c
> ufs_alloccg_block() fs/ufs/balloc.c
> ufs_alloc_fragments() fs/ufs/balloc.c
> ufs_new_fragments() fs/ufs/balloc.c
>
> Reject the cylinder group unless the full BITS_TO_BYTES(s_fpg)
> free-fragment bitmap starting at c_freeoff fits in the bytes actually
> loaded for that cylinder group.

Why not fix the userspace fsck tool to fix this instead of working
around it in the kernel?

thanks,

greg k-h