linux-stable.git/fs/jfs, branch linux-5.11.y

JFS: more checks for invalid superblock

2021-03-07T11:35:44+00:00

commit 3bef198f1b17d1bb89260bad947ef084c0a2d1a6 upstream.

syzbot is feeding invalid superblock data to JFS for mount testing.
JFS does not check several of the fields -- just assumes that they
are good since the JFS_MAGIC and version fields are good.

In this case (syzbot reproducer), we have s_l2bsize == 0xda0c,
pad == 0xf045, and s_state == 0x50, all of which are invalid IMO.
Having s_l2bsize == 0xda0c causes this UBSAN warning:
  UBSAN: shift-out-of-bounds in fs/jfs/jfs_mount.c:373:25
  shift exponent -9716 is negative

s_l2bsize can be tested for correctness. pad can be tested for non-0
and punted. s_state can be tested for its valid values and punted.

Do those 3 tests and if any of them fails, report the superblock as
invalid/corrupt and let fsck handle it.

With this patch, chkSuper() says this when JFS_DEBUG is enabled:
  jfs_mount: Mount Failure: superblock is corrupt!
  Mount JFS Failure: -22
  jfs_mount failed w/return code = -22

The obvious problem with this method is that next week there could
be another syzbot test that uses different fields for invalid values,
this making this like a game of whack-a-mole.

syzkaller link: https://syzkaller.appspot.com/bug?extid=36315852ece4132ec193

Reported-by: syzbot+36315852ece4132ec193@syzkaller.appspotmail.com
Reported-by: kernel test robot  # v2
Signed-off-by: Randy Dunlap 
Signed-off-by: Dave Kleikamp 
Cc: jfs-discussion@lists.sourceforge.net
Signed-off-by: Greg Kroah-Hartman

fs/jfs: fix potential integer overflow on shift of a int

2021-03-04T11:14:28+00:00

[ Upstream commit 4208c398aae4c2290864ba15c3dab7111f32bec1 ]

The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
arithmetic and then assigned to a signed 64 bit integer. In the case where
l2nb is 32 or more this can lead to an overflow.  Avoid this by shifting
the value 1LL instead.

Addresses-Coverity: ("Uninitentional integer overflow")
Fixes: b40c2e665cd5 ("fs/jfs: TRIM support for JFS Filesystem")
Signed-off-by: Colin Ian King 
Signed-off-by: Dave Kleikamp 
Signed-off-by: Sasha Levin

jfs: Fix array index bounds check in dbAdjTree

2020-11-13T22:03:07+00:00

Bounds checking tools can flag a bug in dbAdjTree() for an array index
out of bounds in dmt_stree. Since dmt_stree can refer to the stree in
both structures dmaptree and dmapctl, use the larger array to eliminate
the false positive.

Signed-off-by: Dave Kleikamp 
Reported-by: butt3rflyh4ck

jfs: Fix memleak in dbAdjCtl

2020-11-13T19:43:02+00:00

When dbBackSplit() fails, mp should be released to
prevent memleak. It's the same when dbJoin() fails.

Signed-off-by: Dinghao Liu 
Signed-off-by: Dave Kleikamp

jfs: delete duplicated words + other fixes

2020-11-13T19:36:00+00:00

Delete repeated words in fs/jfs/.
{for, allocation, if, the}
Insert "is" in one place to correct the grammar.

Signed-off-by: Randy Dunlap 
Signed-off-by: Dave Kleikamp 
To: linux-fsdevel@vger.kernel.org
Cc: jfs-discussion@lists.sourceforge.net

fs: Introduce i_blocks_per_page

2020-09-21T15:59:26+00:00

This helper is useful for both THPs and for supporting block size larger
than page size.  Convert all users that I could find (we have a few
different ways of writing this idiom, and I may have missed some).

Signed-off-by: Matthew Wilcox (Oracle) 
Reviewed-by: Christoph Hellwig 
Reviewed-by: Dave Chinner 
Reviewed-by: Darrick J. Wong 
Signed-off-by: Darrick J. Wong 
Acked-by: Dave Kleikamp

block: move struct block_device to blk_types.h

2020-06-24T15:16:02+00:00

Move the struct block_device definition together with most of the
block layer definitions, as it has nothing to do with the rest of fs.h.

Signed-off-by: Christoph Hellwig 
Signed-off-by: Jens Axboe

Merge tag 'jfs-5.8' of git://github.com/kleikamp/linux-shaggy

2020-06-03T03:11:35+00:00

Pull JFS update from David Kleikamp:
 "Replace zero-length array in JFS"

* tag 'jfs-5.8' of git://github.com/kleikamp/linux-shaggy:
  jfs: Replace zero-length array with flexible-array member

fs: convert mpage_readpages to mpage_readahead

2020-06-02T17:59:07+00:00

Implement the new readahead aop and convert all callers (block_dev,
exfat, ext2, fat, gfs2, hpfs, isofs, jfs, nilfs2, ocfs2, omfs, qnx6,
reiserfs & udf).

The callers are all trivial except for GFS2 & OCFS2.

Signed-off-by: Matthew Wilcox (Oracle) 
Signed-off-by: Andrew Morton 
Reviewed-by: Junxiao Bi  # ocfs2
Reviewed-by: Joseph Qi  # ocfs2
Reviewed-by: Dave Chinner 
Reviewed-by: John Hubbard 
Reviewed-by: Christoph Hellwig 
Reviewed-by: William Kucharski 
Cc: Chao Yu 
Cc: Cong Wang 
Cc: Darrick J. Wong 
Cc: Eric Biggers 
Cc: Gao Xiang 
Cc: Jaegeuk Kim 
Cc: Michal Hocko 
Cc: Zi Yan 
Cc: Johannes Thumshirn 
Cc: Miklos Szeredi 
Link: http://lkml.kernel.org/r/20200414150233.24495-17-willy@infradead.org
Signed-off-by: Linus Torvalds

jfs: Replace zero-length array with flexible-array member

2020-03-09T20:18:51+00:00

The current codebase makes use of the zero-length array language
extension to the C90 standard, but the preferred mechanism to declare
variable-length types such as these ones is a flexible array member[1][2],
introduced in C99:

struct foo {
        int stuff;
        struct boo array[];
};

By making use of the mechanism above, we will get a compiler warning
in case the flexible array does not occur last in the structure, which
will help us prevent some kind of undefined behavior bugs from being
inadvertently introduced[3] to the codebase from now on.

Also, notice that, dynamic memory allocations won't be affected by
this change:

"Flexible array members have incomplete type, and so the sizeof operator
may not be applied. As a quirk of the original implementation of
zero-length arrays, sizeof evaluates to zero."[1]

This issue was found with the help of Coccinelle.

[1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html
[2] https://github.com/KSPP/linux/issues/21
[3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour")

Signed-off-by: Gustavo A. R. Silva 
Signed-off-by: Dave Kleikamp