In the Linux kernel, the following vulnerability has been resolved:
FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
Syzkaller reported the following issue:
UBSAN: array-index-out-of-bounds in fs/jfs/jfsdmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> _dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x1e7/0x2d0 lib/dumpstack.c:106 ubsanepilogue lib/ubsan.c:217 [inline] _ubsanhandleoutofbounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfsdmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfsdmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfsdmap.c:2331 dbFreeDmap fs/jfs/jfsdmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfsdmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfstxnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfstxnmgr.c:2664 [inline] jfslazycommit+0x47a/0xb70 fs/jfs/jfstxnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 retfromfork+0x48/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x11/0x20 arch/x86/entry/entry64.S:304
Kernel panic - not syncing: UBSAN: paniconwarn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> _dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x1e7/0x2d0 lib/dumpstack.c:106 panic+0x30f/0x770 kernel/panic.c:340 checkpaniconwarn+0x82/0xa0 kernel/panic.c:236 ubsanepilogue lib/ubsan.c:223 [inline] _ubsanhandleoutofbounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfsdmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfsdmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfsdmap.c:2331 dbFreeDmap fs/jfs/jfsdmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfsdmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfstxnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfstxnmgr.c:2664 [inline] jfslazycommit+0x47a/0xb70 fs/jfs/jfstxnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 retfromfork+0x48/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x11/0x20 arch/x86/entry/entry64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds..
The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue.
Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARNONONCE for lack of a cleaner option.
The patch is tested via syzbot.
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"236647462851840712514699307725327588351",
"102611652884363023455738752474546845426",
"9690899154581855972338968006532462275"
]
},
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98f9537fe61b8382b3cc5dd97347531698517c56",
"id": "CVE-2023-52604-0f5908bf",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "317280892196870452827827916256942489828",
"length": 523.0
},
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbAdjTree"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68",
"id": "CVE-2023-52604-290499a2",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "317280892196870452827827916256942489828",
"length": 523.0
},
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbAdjTree"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42f433785f108893de0dd5260bafb85d7d51db03",
"id": "CVE-2023-52604-7aba1884",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"236647462851840712514699307725327588351",
"102611652884363023455738752474546845426",
"9690899154581855972338968006532462275"
]
},
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fe8b702125aeee6ce83f20092a2341446704e7b",
"id": "CVE-2023-52604-7d4e8409",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"236647462851840712514699307725327588351",
"102611652884363023455738752474546845426",
"9690899154581855972338968006532462275"
]
},
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59342822276f753e49d27ef5eebffbba990572b9",
"id": "CVE-2023-52604-8165ae0c",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "317280892196870452827827916256942489828",
"length": 523.0
},
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbAdjTree"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a44065dd604972ec1fbcccbdc4a70d266a89cdd",
"id": "CVE-2023-52604-818ba57f",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "317280892196870452827827916256942489828",
"length": 523.0
},
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbAdjTree"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59342822276f753e49d27ef5eebffbba990572b9",
"id": "CVE-2023-52604-877909ac",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"236647462851840712514699307725327588351",
"102611652884363023455738752474546845426",
"9690899154581855972338968006532462275"
]
},
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a44065dd604972ec1fbcccbdc4a70d266a89cdd",
"id": "CVE-2023-52604-9d7a3f92",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "317280892196870452827827916256942489828",
"length": 523.0
},
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbAdjTree"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3e95c6850661c77e6dab079d9b5374a618ebb15",
"id": "CVE-2023-52604-a1f32e24",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"236647462851840712514699307725327588351",
"102611652884363023455738752474546845426",
"9690899154581855972338968006532462275"
]
},
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42f433785f108893de0dd5260bafb85d7d51db03",
"id": "CVE-2023-52604-c2240308",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "317280892196870452827827916256942489828",
"length": 523.0
},
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbAdjTree"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de34de6e57bbbc868e4fcf9e98c76b3587cabb0b",
"id": "CVE-2023-52604-ca783705",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "317280892196870452827827916256942489828",
"length": 523.0
},
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbAdjTree"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98f9537fe61b8382b3cc5dd97347531698517c56",
"id": "CVE-2023-52604-d0bb8540",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"236647462851840712514699307725327588351",
"102611652884363023455738752474546845426",
"9690899154581855972338968006532462275"
]
},
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de34de6e57bbbc868e4fcf9e98c76b3587cabb0b",
"id": "CVE-2023-52604-e6283e21",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "317280892196870452827827916256942489828",
"length": 523.0
},
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbAdjTree"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fe8b702125aeee6ce83f20092a2341446704e7b",
"id": "CVE-2023-52604-ebbbc2da",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"236647462851840712514699307725327588351",
"102611652884363023455738752474546845426",
"9690899154581855972338968006532462275"
]
},
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3e95c6850661c77e6dab079d9b5374a618ebb15",
"id": "CVE-2023-52604-ed72b0e9",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"236647462851840712514699307725327588351",
"102611652884363023455738752474546845426",
"9690899154581855972338968006532462275"
]
},
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68",
"id": "CVE-2023-52604-f6694305",
"deprecated": false,
"signature_version": "v1"
}
]