Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a4855aeb authored by Siddh Raman Pant's avatar Siddh Raman Pant Committed by Greg Kroah-Hartman
Browse files

jfs: jfs_dmap: Validate db_l2nbperpage while mounting 



commit 11509910c599cbd04585ec35a6d5e1a0053d84c1 upstream.

In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block
number inside dbFree(). db_l2nbperpage, which is the log2 number of
blocks per page, is passed as an argument to BLKTODMAP which uses it
for shifting.

Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is
too big. This happens because the large value is set without any
validation in dbMount() at line 181.

Thus, make sure that db_l2nbperpage is correct while mounting.

Max number of blocks per page = Page size / Min block size
=> log2(Max num_block per page) = log2(Page size / Min block size)
				= log2(Page size) - log2(Min block size)

=> Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE

Reported-and-tested-by: default avatar <syzbot+d2cd27dcf8e04b232eb2@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?id=2a70a453331db32ed491f5cbb07e81bf2d225715


Cc: stable@vger.kernel.org
Suggested-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: default avatarSiddh Raman Pant <code@siddh.me>
Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ee2fd448

fs/jfs/jfs_dmap.c

+6 −0
Original line number Diff line number Diff line
@@ -178,7 +178,13 @@ int dbMount(struct inode *ipbmap) 
	dbmp_le = (struct dbmap_disk *) mp->data;

	bmp->db_mapsize = le64_to_cpu(dbmp_le->dn_mapsize);

	bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree);



	bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage);

	if (bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE) {

		err = -EINVAL;

		goto err_release_metapage;

	}



	bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);

	if (!bmp->db_numag) {

		err = -EINVAL;

fs/jfs/jfs_filsys.h

+2 −0
Original line number Diff line number Diff line
@@ -122,7 +122,9 @@ 
#define NUM_INODE_PER_IAG	INOSPERIAG



#define MINBLOCKSIZE		512

#define L2MINBLOCKSIZE		9

#define MAXBLOCKSIZE		4096

#define L2MAXBLOCKSIZE		12

#define	MAXFILESIZE		((s64)1 << 52)



#define JFS_LINK_MAX		0xffffffff