Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 50163a11 authored by Hoi Pok Wu's avatar Hoi Pok Wu Committed by Greg Kroah-Hartman
Browse files

fs: jfs: fix shift-out-of-bounds in dbDiscardAG 



[ Upstream commit 25e70c6162f207828dd405b432d8f2a98dbf7082 ]

This should be applied to most URSAN bugs found recently by syzbot,
by guarding the dbMount. As syzbot feeding rubbish into the bmap
descriptor.

Signed-off-by: default avatarHoi Pok Wu <wuhoipok@gmail.com>
Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 156d440d

fs/jfs/jfs_dmap.c

+5 −0
Original line number Diff line number Diff line
@@ -198,6 +198,11 @@ int dbMount(struct inode *ipbmap) 
		goto err_release_metapage;

	}



	if (((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) {

		err = -EINVAL;

		goto err_release_metapage;

	}



	for (i = 0; i < MAXAG; i++)

		bmp->db_agfree[i] = le64_to_cpu(dbmp_le->dn_agfree[i]);

	bmp->db_agsize = le64_to_cpu(dbmp_le->dn_agsize);