3bef198f1b
syzbot is feeding invalid superblock data to JFS for mount testing. JFS does not check several of the fields -- just assumes that they are good since the JFS_MAGIC and version fields are good. In this case (syzbot reproducer), we have s_l2bsize == 0xda0c, pad == 0xf045, and s_state == 0x50, all of which are invalid IMO. Having s_l2bsize == 0xda0c causes this UBSAN warning: UBSAN: shift-out-of-bounds in fs/jfs/jfs_mount.c:373:25 shift exponent -9716 is negative s_l2bsize can be tested for correctness. pad can be tested for non-0 and punted. s_state can be tested for its valid values and punted. Do those 3 tests and if any of them fails, report the superblock as invalid/corrupt and let fsck handle it. With this patch, chkSuper() says this when JFS_DEBUG is enabled: jfs_mount: Mount Failure: superblock is corrupt! Mount JFS Failure: -22 jfs_mount failed w/return code = -22 The obvious problem with this method is that next week there could be another syzbot test that uses different fields for invalid values, this making this like a game of whack-a-mole. syzkaller link: https://syzkaller.appspot.com/bug?extid=36315852ece4132ec193 Reported-by: syzbot+36315852ece4132ec193@syzkaller.appspotmail.com Reported-by: kernel test robot <lkp@intel.com> # v2 Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> Cc: jfs-discussion@lists.sourceforge.net |
||
|---|---|---|
| .. | ||
| acl.c | ||
| file.c | ||
| inode.c | ||
| ioctl.c | ||
| jfs_acl.h | ||
| jfs_btree.h | ||
| jfs_debug.c | ||
| jfs_debug.h | ||
| jfs_dinode.h | ||
| jfs_discard.c | ||
| jfs_discard.h | ||
| jfs_dmap.c | ||
| jfs_dmap.h | ||
| jfs_dtree.c | ||
| jfs_dtree.h | ||
| jfs_extent.c | ||
| jfs_extent.h | ||
| jfs_filsys.h | ||
| jfs_imap.c | ||
| jfs_imap.h | ||
| jfs_incore.h | ||
| jfs_inode.c | ||
| jfs_inode.h | ||
| jfs_lock.h | ||
| jfs_logmgr.c | ||
| jfs_logmgr.h | ||
| jfs_metapage.c | ||
| jfs_metapage.h | ||
| jfs_mount.c | ||
| jfs_superblock.h | ||
| jfs_txnmgr.c | ||
| jfs_txnmgr.h | ||
| jfs_types.h | ||
| jfs_umount.c | ||
| jfs_unicode.c | ||
| jfs_unicode.h | ||
| jfs_uniupr.c | ||
| jfs_xattr.h | ||
| jfs_xtree.c | ||
| jfs_xtree.h | ||
| Kconfig | ||
| Makefile | ||
| namei.c | ||
| resize.c | ||
| super.c | ||
| symlink.c | ||
| xattr.c | ||