diff options
| author | Arnaud Lecomte <contact@arnaud-lcm.com> | 2025-04-24 00:13:51 +0200 |
|---|---|---|
| committer | Dave Kleikamp <dave.kleikamp@oracle.com> | 2025-07-14 17:08:13 -0500 |
| commit | c214006856ff52a8ff17ed8da52d50601d54f9ce (patch) | |
| tree | 76d7a8f3fb4a97ff66a26f2d34b35a6a36aa170b /fs/jfs | |
| parent | Merge tag 'net-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/net... (diff) | |
| download | linux-c214006856ff52a8ff17ed8da52d50601d54f9ce.tar.gz linux-c214006856ff52a8ff17ed8da52d50601d54f9ce.zip | |
jfs: upper bound check of tree index in dbAllocAG
When computing the tree index in dbAllocAG, we never check if we are
out of bounds realative to the size of the stree.
This could happen in a scenario where the filesystem metadata are
corrupted.
Reported-by: syzbot+cffd18309153948f3c3e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cffd18309153948f3c3e
Tested-by: syzbot+cffd18309153948f3c3e@syzkaller.appspotmail.com
Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Diffstat (limited to 'fs/jfs')
| -rw-r--r-- | fs/jfs/jfs_dmap.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 35e063c9f3a4..5080d59089bd 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1389,6 +1389,12 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results) (1 << (L2LPERCTL - (bmp->db_agheight << 1))) / bmp->db_agwidth; ti = bmp->db_agstart + bmp->db_agwidth * (agno & (agperlev - 1)); + if (ti < 0 || ti >= le32_to_cpu(dcp->nleafs)) { + jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n"); + release_metapage(mp); + return -EIO; + } + /* dmap control page trees fan-out by 4 and a single allocation * group may be described by 1 or 2 subtrees within the ag level * dmap control page, depending upon the ag size. examine the ag's |