CVE-2022-50478

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()<br /> <br /> Patch series "nilfs2: fix UBSAN shift-out-of-bounds warnings on mount<br /> time".<br /> <br /> The first patch fixes a bug reported by syzbot, and the second one fixes<br /> the remaining bug of the same kind. Although they are triggered by the<br /> same super block data anomaly, I divided it into the above two because the<br /> details of the issues and how to fix it are different.<br /> <br /> Both are required to eliminate the shift-out-of-bounds issues at mount<br /> time.<br /> <br /> <br /> This patch (of 2):<br /> <br /> If the block size exponent information written in an on-disk superblock is<br /> corrupted, nilfs_sb2_bad_offset helper function can trigger<br /> shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn<br /> is set):<br /> <br /> shift exponent 38983 is too large for 64-bit type &amp;#39;unsigned long long&amp;#39;<br /> Call Trace:<br /> <br /> __dump_stack lib/dump_stack.c:88 [inline]<br /> dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106<br /> ubsan_epilogue lib/ubsan.c:151 [inline]<br /> __ubsan_handle_shift_out_of_bounds+0x33d/0x3b0 lib/ubsan.c:322<br /> nilfs_sb2_bad_offset fs/nilfs2/the_nilfs.c:449 [inline]<br /> nilfs_load_super_block+0xdf5/0xe00 fs/nilfs2/the_nilfs.c:523<br /> init_nilfs+0xb7/0x7d0 fs/nilfs2/the_nilfs.c:577<br /> nilfs_fill_super+0xb1/0x5d0 fs/nilfs2/super.c:1047<br /> nilfs_mount+0x613/0x9b0 fs/nilfs2/super.c:1317<br /> ...<br /> <br /> In addition, since nilfs_sb2_bad_offset() performs multiplication without<br /> considering the upper bound, the computation may overflow if the disk<br /> layout parameters are not normal.<br /> <br /> This fixes these issues by inserting preliminary sanity checks for those<br /> parameters and by converting the comparison from one involving<br /> multiplication and left bit-shifting to one using division and right<br /> bit-shifting.