This is a note to let you know that I've just added the patch titled ext4: fix undefined behavior in bit shift for ext4_check_flag_values to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ext4-fix-undefined-behavior-in-bit-shift-for-ext4_check_flag_values.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 3bf678a0f9c017c9ba7c581541dbc8453452a7ae Mon Sep 17 00:00:00 2001 From: Gaosheng Cui <cuigaosheng1@xxxxxxxxxx> Date: Mon, 31 Oct 2022 13:58:33 +0800 Subject: ext4: fix undefined behavior in bit shift for ext4_check_flag_values From: Gaosheng Cui <cuigaosheng1@xxxxxxxxxx> commit 3bf678a0f9c017c9ba7c581541dbc8453452a7ae upstream. Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in fs/ext4/ext4.h:591:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c ext4_init_fs+0x5a/0x277 do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422 kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK> Fixes: 9a4c80194713 ("ext4: ensure Inode flags consistency are checked at build time") Signed-off-by: Gaosheng Cui <cuigaosheng1@xxxxxxxxxx> Link: https://lore.kernel.org/r/20221031055833.3966222-1-cuigaosheng1@xxxxxxxxxx Signed-off-by: Theodore Ts'o <tytso@xxxxxxx> Cc: stable@xxxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/ext4/ext4.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -501,7 +501,7 @@ enum { * * It's not paranoia if the Murphy's Law really *is* out to get you. :-) */ -#define TEST_FLAG_VALUE(FLAG) (EXT4_##FLAG##_FL == (1 << EXT4_INODE_##FLAG)) +#define TEST_FLAG_VALUE(FLAG) (EXT4_##FLAG##_FL == (1U << EXT4_INODE_##FLAG)) #define CHECK_FLAG_VALUE(FLAG) BUILD_BUG_ON(!TEST_FLAG_VALUE(FLAG)) static inline void ext4_check_flag_values(void) Patches currently in stable-queue which might be from cuigaosheng1@xxxxxxxxxx are queue-5.4/lib-fonts-fix-undefined-behavior-in-bit-shift-for-ge.patch queue-5.4/rtc-pic32-move-devm_rtc_allocate_device-earlier-in-p.patch queue-5.4/scsi-snic-fix-possible-uaf-in-snic_tgt_create.patch queue-5.4/remoteproc-sysmon-fix-memory-leak-in-qcom_add_sysmon.patch queue-5.4/crypto-img-hash-fix-variable-dereferenced-before-che.patch queue-5.4/crypto-ccree-remove-debugfs-when-platform_driver_reg.patch queue-5.4/alsa-mts64-fix-possible-null-ptr-defer-in-snd_mts64_.patch queue-5.4/ext4-fix-undefined-behavior-in-bit-shift-for-ext4_check_flag_values.patch queue-5.4/staging-vme_user-fix-possible-uaf-in-tsi148_dma_list.patch queue-5.4/apparmor-fix-a-memleak-in-multi_transaction_new.patch queue-5.4/rtc-st-lpc-add-missing-clk_disable_unprepare-in-st_r.patch