This is a note to let you know that I've just added the patch titled
ext4: fix undefined behavior in bit shift for ext4_check_flag_values
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ext4-fix-undefined-behavior-in-bit-shift-for-ext4_check_flag_values.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 3bf678a0f9c017c9ba7c581541dbc8453452a7ae Mon Sep 17 00:00:00 2001
From: Gaosheng Cui <cuigaosheng1@xxxxxxxxxx>
Date: Mon, 31 Oct 2022 13:58:33 +0800
Subject: ext4: fix undefined behavior in bit shift for ext4_check_flag_values
From: Gaosheng Cui <cuigaosheng1@xxxxxxxxxx>
commit 3bf678a0f9c017c9ba7c581541dbc8453452a7ae upstream.
Shifting signed 32-bit value by 31 bits is undefined, so changing
significant bit to unsigned. The UBSAN warning calltrace like below:
UBSAN: shift-out-of-bounds in fs/ext4/ext4.h:591:2
left shift of 1 by 31 places cannot be represented in type 'int'
Call Trace:
<TASK>
dump_stack_lvl+0x7d/0xa5
dump_stack+0x15/0x1b
ubsan_epilogue+0xe/0x4e
__ubsan_handle_shift_out_of_bounds+0x1e7/0x20c
ext4_init_fs+0x5a/0x277
do_one_initcall+0x76/0x430
kernel_init_freeable+0x3b3/0x422
kernel_init+0x24/0x1e0
ret_from_fork+0x1f/0x30
</TASK>
Fixes: 9a4c80194713 ("ext4: ensure Inode flags consistency are checked at build time")
Signed-off-by: Gaosheng Cui <cuigaosheng1@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20221031055833.3966222-1-cuigaosheng1@xxxxxxxxxx
Signed-off-by: Theodore Ts'o <tytso@xxxxxxx>
Cc: stable@xxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/ext4/ext4.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -503,7 +503,7 @@ enum {
*
* It's not paranoia if the Murphy's Law really *is* out to get you. :-)
*/
-#define TEST_FLAG_VALUE(FLAG) (EXT4_##FLAG##_FL == (1 << EXT4_INODE_##FLAG))
+#define TEST_FLAG_VALUE(FLAG) (EXT4_##FLAG##_FL == (1U << EXT4_INODE_##FLAG))
#define CHECK_FLAG_VALUE(FLAG) BUILD_BUG_ON(!TEST_FLAG_VALUE(FLAG))
static inline void ext4_check_flag_values(void)
Patches currently in stable-queue which might be from cuigaosheng1@xxxxxxxxxx are
queue-4.19/scsi-snic-fix-possible-uaf-in-snic_tgt_create.patch
queue-4.19/crypto-img-hash-fix-variable-dereferenced-before-che.patch
queue-4.19/alsa-mts64-fix-possible-null-ptr-defer-in-snd_mts64_.patch
queue-4.19/ext4-fix-undefined-behavior-in-bit-shift-for-ext4_check_flag_values.patch
queue-4.19/staging-vme_user-fix-possible-uaf-in-tsi148_dma_list.patch
queue-4.19/apparmor-fix-a-memleak-in-multi_transaction_new.patch
queue-4.19/rtc-st-lpc-add-missing-clk_disable_unprepare-in-st_r.patch
