Commit e584bbe8 authored Dec 09, 2020 by Chao Yu Committed by Jaegeuk Kim Dec 10, 2020

f2fs: fix shift-out-of-bounds in sanity_check_raw_super()



syzbot reported a bug which could cause shift-out-of-bounds issue,
fix it.

Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 sanity_check_raw_super fs/f2fs/super.c:2812 [inline]
 read_raw_super_block fs/f2fs/super.c:3267 [inline]
 f2fs_fill_super.cold+0x16c9/0x16f6 fs/f2fs/super.c:3519
 mount_bdev+0x34d/0x410 fs/super.c:1366
 legacy_get_tree+0x105/0x220 fs/fs_context.c:592
 vfs_get_tree+0x89/0x2f0 fs/super.c:1496
 do_new_mount fs/namespace.c:2896 [inline]
 path_mount+0x12ae/0x1e70 fs/namespace.c:3227
 do_mount fs/namespace.c:3240 [inline]
 __do_sys_mount fs/namespace.c:3448 [inline]
 __se_sys_mount fs/namespace.c:3425 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3425
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported-by:  <syzbot+ca9a785f8ac472085994@syzkaller.appspotmail.com>
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

parent 6422a71e

fs/f2fs/super.c

+4 −5

Original line number	Diff line number	Diff line
		@@ -2775,7 +2775,6 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
		block_t total_sections, blocks_per_seg;
		struct f2fs_super_block raw_super = (struct f2fs_super_block )
		(bh->b_data + F2FS_SUPER_OFFSET);
		unsigned int blocksize;
		size_t crc_offset = 0;
		__u32 crc = 0;

		@@ -2802,10 +2801,10 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
		}

		/* Currently, support only 4KB block size */
		blocksize = 1 << le32_to_cpu(raw_super->log_blocksize);
		if (blocksize != F2FS_BLKSIZE) {
		f2fs_info(sbi, "Invalid blocksize (%u), supports only 4KB",
		blocksize);
		if (le32_to_cpu(raw_super->log_blocksize) != F2FS_BLKSIZE_BITS) {
		f2fs_info(sbi, "Invalid log_blocksize (%u), supports only %u",
		le32_to_cpu(raw_super->log_blocksize),
		F2FS_BLKSIZE_BITS);
		return -EFSCORRUPTED;
		}

Admin message