diff options
| author | Ryusuke Konishi <konishi.ryusuke@gmail.com> | 2022-10-27 13:43:06 +0900 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2022-11-18 13:55:08 -0800 |
| commit | ebeccaaef67a4895d2496ab8d9c2fb8d89201211 (patch) | |
| tree | 583f826c27589f9bb884ffa61cadebf1682a3ead /init/initramfs.c | |
| parent | 610a2a3d7d8be3537458a378ec69396a76c385b6 (diff) | |
| download | linux-ebeccaaef67a4895d2496ab8d9c2fb8d89201211.tar.bz2 | |
nilfs2: fix shift-out-of-bounds due to too large exponent of block size
If field s_log_block_size of superblock data is corrupted and too large,
init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds
warning followed by a kernel panic (if panic_on_warn is set):
shift exponent 38973 is too large for 32-bit type 'int'
Call Trace:
<TASK>
dump_stack_lvl+0xcd/0x134
ubsan_epilogue+0xb/0x50
__ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5
init_nilfs.cold.11+0x18/0x1d [nilfs2]
nilfs_mount+0x9b5/0x12b0 [nilfs2]
...
This fixes the issue by adding and using a new helper function for getting
block size with sanity check.
Link: https://lkml.kernel.org/r/20221027044306.42774-3-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'init/initramfs.c')
0 files changed, 0 insertions, 0 deletions