linux-stable/fs/nilfs2
Jeongjun Park c4a7dc9523 nilfs2: fix OOB in nilfs_set_de_type
The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is
defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function,
which uses this array, specifies the index to read from the array in the
same way as "(mode & S_IFMT) >> S_SHIFT".

static void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode
 *inode)
{
	umode_t mode = inode->i_mode;

	de->file_type = nilfs_type_by_mode[(mode & S_IFMT)>>S_SHIFT]; // oob
}

However, when the index is determined this way, an out-of-bounds (OOB)
error occurs by referring to an index that is 1 larger than the array size
when the condition "mode & S_IFMT == S_IFMT" is satisfied.  Therefore, a
patch to resize the nilfs_type_by_mode array should be applied to prevent
OOB errors.

Link: https://lkml.kernel.org/r/20240415182048.7144-1-konishi.ryusuke@gmail.com
Reported-by: syzbot+2e22057de05b9f3b30d8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2e22057de05b9f3b30d8
Fixes: 2ba466d74e ("nilfs2: directory entry operations")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-04-16 15:39:52 -07:00
..
alloc.c nilfs2: convert persistent object allocator to use kmap_local 2024-02-22 15:38:53 -08:00
alloc.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
bmap.c nilfs2: do not acquire rwsem in nilfs_bmap_write() 2024-02-22 15:38:53 -08:00
bmap.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
btnode.c nilfs2: convert nilfs_page_bug() to nilfs_folio_bug() 2023-12-10 17:21:48 -08:00
btnode.h fs/nilfs2: Use the enum req_op and blk_opf_t types 2022-07-14 12:14:33 -06:00
btree.c nilfs2: fix failure to detect DAT corruption in btree and direct mappings 2024-03-14 09:17:29 -07:00
btree.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
cpfile.c nilfs2: use div64_ul() instead of do_div() 2024-03-12 13:09:23 -07:00
cpfile.h nilfs2: remove nilfs_cpfile_{get,put}_checkpoint() 2024-02-22 15:38:53 -08:00
dat.c nilfs2: use div64_ul() instead of do_div() 2024-03-12 13:09:23 -07:00
dat.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
dir.c nilfs2: fix OOB in nilfs_set_de_type 2024-04-16 15:39:52 -07:00
direct.c nilfs2: fix failure to detect DAT corruption in btree and direct mappings 2024-03-14 09:17:29 -07:00
direct.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
export.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
file.c nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() 2024-02-07 21:20:36 -08:00
gcinode.c nilfs2: convert nilfs_gccache_submit_read_data to use a folio 2023-12-10 17:21:29 -08:00
ifile.c nilfs2: localize highmem mapping for checkpoint reading within cpfile 2024-02-22 15:38:53 -08:00
ifile.h nilfs2: localize highmem mapping for checkpoint reading within cpfile 2024-02-22 15:38:53 -08:00
inode.c nilfs2: prevent kernel bug at submit_bh_wbc() 2024-03-14 09:17:30 -07:00
ioctl.c nilfs2: use div64_ul() instead of do_div() 2024-03-12 13:09:23 -07:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mdt.c nilfs2: convert metadata file common code to use kmap_local 2024-02-22 15:38:53 -08:00
mdt.h nilfs2: fix lockdep warnings during disk space reclamation 2022-04-01 11:46:09 -07:00
namei.c misc cleanups (the part that hadn't been picked by individual fs trees) 2024-01-11 20:23:50 -08:00
nilfs.h nilfs2: move nilfs_bmap_write call out of nilfs_write_inode_common 2024-02-22 15:38:53 -08:00
page.c nilfs2: convert nilfs_copy_buffer() to use kmap_local 2024-02-22 15:38:53 -08:00
page.h nilfs2: convert nilfs_page_bug() to nilfs_folio_bug() 2023-12-10 17:21:48 -08:00
recovery.c nilfs2: convert recovery logic to use kmap_local 2024-02-22 15:38:52 -08:00
segbuf.c nilfs2: convert segment buffer to use kmap_local 2024-02-22 15:38:53 -08:00
segbuf.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
segment.c nilfs2: localize highmem mapping for checkpoint finalization within cpfile 2024-02-22 15:38:53 -08:00
segment.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
sufile.c nilfs2: use div64_ul() instead of do_div() 2024-03-12 13:09:23 -07:00
sufile.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
super.c nilfs2: use div64_ul() instead of do_div() 2024-03-12 13:09:23 -07:00
sysfs.c nilfs2: use default_groups in kobj_type 2021-12-29 10:53:48 +01:00
sysfs.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
the_nilfs.c nilfs2: use div64_ul() instead of do_div() 2024-03-12 13:09:23 -07:00
the_nilfs.h nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput 2023-08-04 13:03:43 -07:00