)]}'
{
  "commit": "16a747f85ff3b4ac1fa0deff5916d08d0cbb234d",
  "tree": "465a20b3848d5ecd7dd583c848b039de8a7e3652",
  "parents": [
    "1bc63ace6716f85fe792dcea65f46313874ade7b"
  ],
  "author": {
    "name": "Tudor Ambarus",
    "email": "tudor.ambarus@linaro.org",
    "time": "Thu May 04 12:15:25 2023 +0000"
  },
  "committer": {
    "name": "Oleksandr Tymoshenko",
    "email": "ovt@google.com",
    "time": "Mon Jun 12 22:28:34 2023 +0000"
  },
  "message": "ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum\n\ncommit 4f04351888a83e595571de672e0a4a8b74f4fb31 upstream.\n\nWhen modifying the block device while it is mounted by the filesystem,\nsyzbot reported the following:\n\nBUG: KASAN: slab-out-of-bounds in crc16+0x206/0x280 lib/crc16.c:58\nRead of size 1 at addr ffff888075f5c0a8 by task syz-executor.2/15586\n\nCPU: 1 PID: 15586 Comm: syz-executor.2 Not tainted 6.2.0-rc5-syzkaller-00205-gc96618275234 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106\n print_address_description+0x74/0x340 mm/kasan/report.c:306\n print_report+0x107/0x1f0 mm/kasan/report.c:417\n kasan_report+0xcd/0x100 mm/kasan/report.c:517\n crc16+0x206/0x280 lib/crc16.c:58\n ext4_group_desc_csum+0x81b/0xb20 fs/ext4/super.c:3187\n ext4_group_desc_csum_set+0x195/0x230 fs/ext4/super.c:3210\n ext4_mb_clear_bb fs/ext4/mballoc.c:6027 [inline]\n ext4_free_blocks+0x191a/0x2810 fs/ext4/mballoc.c:6173\n ext4_remove_blocks fs/ext4/extents.c:2527 [inline]\n ext4_ext_rm_leaf fs/ext4/extents.c:2710 [inline]\n ext4_ext_remove_space+0x24ef/0x46a0 fs/ext4/extents.c:2958\n ext4_ext_truncate+0x177/0x220 fs/ext4/extents.c:4416\n ext4_truncate+0xa6a/0xea0 fs/ext4/inode.c:4342\n ext4_setattr+0x10c8/0x1930 fs/ext4/inode.c:5622\n notify_change+0xe50/0x1100 fs/attr.c:482\n do_truncate+0x200/0x2f0 fs/open.c:65\n handle_truncate fs/namei.c:3216 [inline]\n do_open fs/namei.c:3561 [inline]\n path_openat+0x272b/0x2dd0 fs/namei.c:3714\n do_filp_open+0x264/0x4f0 fs/namei.c:3741\n do_sys_openat2+0x124/0x4e0 fs/open.c:1310\n do_sys_open fs/open.c:1326 [inline]\n __do_sys_creat fs/open.c:1402 [inline]\n __se_sys_creat fs/open.c:1396 [inline]\n __x64_sys_creat+0x11f/0x160 fs/open.c:1396\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7f72f8a8c0c9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f72f97e3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000055\nRAX: ffffffffffffffda RBX: 00007f72f8bac050 RCX: 00007f72f8a8c0c9\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000280\nRBP: 00007f72f8ae7ae9 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007ffd165348bf R14: 00007f72f97e3300 R15: 0000000000022000\n\nReplace\n\tle16_to_cpu(sbi-\u003es_es-\u003es_desc_size)\nwith\n\tsbi-\u003es_desc_size\n\nIt reduces ext4\u0027s compiled text size, and makes the code more efficient\n(we remove an extra indirect reference and a potential byte\nswap on big endian systems), and there is no downside. It also avoids the\npotential KASAN / syzkaller failure, as a bonus.\n\nBUG\u003db/286372061\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2023-34256 in the Linux kernel.\n\ncos-patch: security-moderate\nReported-by: syzbot+fc51227e7100c9294894@syzkaller.appspotmail.com\nReported-by: syzbot+8785e41224a3afd04321@syzkaller.appspotmail.com\nLink: https://syzkaller.appspot.com/bug?id\u003d70d28d11ab14bd7938f3e088365252aa923cff42\nLink: https://syzkaller.appspot.com/bug?id\u003db85721b38583ecc6b5e72ff524c67302abbc30f3\nLink: https://lore.kernel.org/all/000000000000ece18705f3b20934@google.com/\nFixes: 717d50e4971b (\"Ext4: Uninitialized Block Groups\")\nCc: stable@vger.kernel.org\nSigned-off-by: Tudor Ambarus \u003ctudor.ambarus@linaro.org\u003e\nLink: https://lore.kernel.org/r/20230504121525.3275886-1-tudor.ambarus@linaro.org\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nChange-Id: I09fb7b9918a7c9ce5267787a9a1449f739aa3622\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/50569\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Meena Shanmugam \u003cmeenashanmugam@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d19f34bb1aae307f1b1db058e75d3652cb7c206d",
      "old_mode": 33188,
      "old_path": "fs/ext4/super.c",
      "new_id": "b1aab48e981bf121e86088dd29d2001201887d5c",
      "new_mode": 33188,
      "new_path": "fs/ext4/super.c"
    }
  ]
}