From: Andreas Gruenbacher <agruenba@redhat.com>
To: Andrew Price <anprice@redhat.com>
Cc: gfs2@lists.linux.dev,
syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com
Subject: Re: [PATCH v2] gfs2: Validate i_depth for exhash directories
Date: Wed, 16 Jul 2025 15:42:11 +0200 [thread overview]
Message-ID: <CAHc6FU4TsVx7NiuYFTFVFs6zFkeUP0=bxu2L4aAP_9PicMqEMQ@mail.gmail.com> (raw)
In-Reply-To: <20250716131207.79856-1-anprice@redhat.com>
On Wed, Jul 16, 2025 at 3:12 PM Andrew Price <anprice@redhat.com> wrote:
> A fuzzer test introduced corruption that ends up with a depth of 0 in
> dir_e_read(), causing an undefined shift by 32 at:
>
> index = hash >> (32 - dip->i_depth);
>
> As calculated in an open-coded way in dir_make_exhash(), the minimum
> depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is
> invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time.
>
> So we can avoid the undefined behaviour by checking for depth values
> lower than the minimum in gfs2_dinode_in(). Values greater than the
> maximum are already being checked for there.
>
> Also switch the calculation in dir_make_exhash() to use ilog2() to
> clarify how the depth is calculated.
>
> Tested with the syzkaller repro.c and xfstests '-g quick'.
>
> Reported-by: syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com
> Signed-off-by: Andrew Price <anprice@redhat.com>
> ---
>
> v2:
> - Switch to using ilog2() in dir_make_exhash() as well
> - Include linux/log2.h explicitly
> - Re-tested
>
> fs/gfs2/dir.c | 6 ++----
> fs/gfs2/glops.c | 5 +++++
> 2 files changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
> index dbf1aede744c1..509e2f0d97e78 100644
> --- a/fs/gfs2/dir.c
> +++ b/fs/gfs2/dir.c
> @@ -60,6 +60,7 @@
> #include <linux/crc32.h>
> #include <linux/vmalloc.h>
> #include <linux/bio.h>
> +#include <linux/log2.h>
>
> #include "gfs2.h"
> #include "incore.h"
> @@ -912,7 +913,6 @@ static int dir_make_exhash(struct inode *inode)
> struct qstr args;
> struct buffer_head *bh, *dibh;
> struct gfs2_leaf *leaf;
> - int y;
> u32 x;
> __be64 *lp;
> u64 bn;
> @@ -979,9 +979,7 @@ static int dir_make_exhash(struct inode *inode)
> i_size_write(inode, sdp->sd_sb.sb_bsize / 2);
> gfs2_add_inode_blocks(&dip->i_inode, 1);
> dip->i_diskflags |= GFS2_DIF_EXHASH;
> -
> - for (x = sdp->sd_hash_ptrs, y = -1; x; x >>= 1, y++) ;
> - dip->i_depth = y;
> + dip->i_depth = ilog2(sdp->sd_hash_ptrs);
>
> gfs2_dinode_out(dip, dibh->b_data);
>
> diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
> index cebd66b22694c..66684ed77dfc3 100644
> --- a/fs/gfs2/glops.c
> +++ b/fs/gfs2/glops.c
> @@ -11,6 +11,7 @@
> #include <linux/bio.h>
> #include <linux/posix_acl.h>
> #include <linux/security.h>
> +#include <linux/log2.h>
>
> #include "gfs2.h"
> #include "incore.h"
> @@ -450,6 +451,10 @@ static int gfs2_dinode_in(struct gfs2_inode *ip, const void *buf)
> gfs2_consist_inode(ip);
> return -EIO;
> }
> + if ((ip->i_diskflags & GFS2_DIF_EXHASH) && depth < ilog2(sdp->sd_hash_ptrs)) {
> + gfs2_consist_inode(ip);
> + return -EIO;
> + }
> ip->i_depth = (u8)depth;
> ip->i_entries = be32_to_cpu(str->di_entries);
>
> --
> 2.50.1
>
Applied to for-next, thanks.
Andreas
prev parent reply other threads:[~2025-07-16 13:42 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-16 13:12 [PATCH v2] gfs2: Validate i_depth for exhash directories Andrew Price
2025-07-16 13:42 ` Andreas Gruenbacher [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHc6FU4TsVx7NiuYFTFVFs6zFkeUP0=bxu2L4aAP_9PicMqEMQ@mail.gmail.com' \
--to=agruenba@redhat.com \
--cc=anprice@redhat.com \
--cc=gfs2@lists.linux.dev \
--cc=syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).