syzbot reported a bug which could cause shift-out-of-bounds issue,
fix it.

Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395
 sanity_check_raw_super fs/f2fs/super.c:2812 [inline]
 read_raw_super_block fs/f2fs/super.c:3267 [inline]
 f2fs_fill_super.cold+0x16c9/0x16f6 fs/f2fs/super.c:3519
 mount_bdev+0x34d/0x410 fs/super.c:1366
 legacy_get_tree+0x105/0x220 fs/fs_context.c:592
 vfs_get_tree+0x89/0x2f0 fs/super.c:1496
 do_new_mount fs/namespace.c:2896 [inline]
 path_mount+0x12ae/0x1e70 fs/namespace.c:3227
 do_mount fs/namespace.c:3240 [inline]
 __do_sys_mount fs/namespace.c:3448 [inline]
 __se_sys_mount fs/namespace.c:3425 [inline]
 __x64_sys_mount+0x27f/0x300 fs/namespace.c:3425
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported-by: [email protected]
Signed-off-by: Chao Yu <[email protected]>
---
 fs/f2fs/super.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index bf96f5776f99..c0b2ea596b07 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -2869,7 +2869,6 @@ static int sanity_check_raw_super(struct f2fs_sb_info 
*sbi,
        block_t total_sections, blocks_per_seg;
        struct f2fs_super_block *raw_super = (struct f2fs_super_block *)
                                        (bh->b_data + F2FS_SUPER_OFFSET);
-       unsigned int blocksize;
        size_t crc_offset = 0;
        __u32 crc = 0;
 
@@ -2896,10 +2895,10 @@ static int sanity_check_raw_super(struct f2fs_sb_info 
*sbi,
        }
 
        /* Currently, support only 4KB block size */
-       blocksize = 1 << le32_to_cpu(raw_super->log_blocksize);
-       if (blocksize != F2FS_BLKSIZE) {
-               f2fs_info(sbi, "Invalid blocksize (%u), supports only 4KB",
-                         blocksize);
+       if (le32_to_cpu(raw_super->log_blocksize) != F2FS_BLKSIZE_BITS) {
+               f2fs_info(sbi, "Invalid log_blocksize (%u), supports only %u",
+                         le32_to_cpu(raw_super->log_blocksize),
+                         F2FS_BLKSIZE_BITS);
                return -EFSCORRUPTED;
        }
 
-- 
2.29.2



_______________________________________________
Linux-f2fs-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Reply via email to