Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 32bd8f1c authored by Juntong Deng's avatar Juntong Deng Committed by Greg Kroah-Hartman
Browse files

fs/jfs: Add validity check for db_maxag and db_agpref 



[ Upstream commit 64933ab7b04881c6c18b21ff206c12278341c72e ]

Both db_maxag and db_agpref are used as the index of the
db_agfree array, but there is currently no validity check for
db_maxag and db_agpref, which can lead to errors.

The following is related bug reported by Syzbot:

UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:639:20
index 7936 is out of range for type 'atomic_t[128]'

Add checking that the values of db_maxag and db_agpref are valid
indexes for the db_agfree array.

Reported-by: default avatar <syzbot+38e876a8aa44b7115c76@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=38e876a8aa44b7115c76


Signed-off-by: default avatarJuntong Deng <juntong.deng@outlook.com>
Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent a81a56b4

fs/jfs/jfs_dmap.c

+6 −0
Original line number Diff line number Diff line
@@ -195,6 +195,12 @@ int dbMount(struct inode *ipbmap) 
	bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel);

	bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag);

	bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref);

	if (bmp->db_maxag >= MAXAG || bmp->db_maxag < 0 ||

		bmp->db_agpref >= MAXAG || bmp->db_agpref < 0) {

		err = -EINVAL;

		goto err_release_metapage;

	}



	bmp->db_aglevel = le32_to_cpu(dbmp_le->dn_aglevel);

	bmp->db_agheight = le32_to_cpu(dbmp_le->dn_agheight);

	bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth);