[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20221217152727.98061-4-sashal@kernel.org>
Date: Sat, 17 Dec 2022 10:27:05 -0500
From: Sasha Levin <sashal@...nel.org>
To: linux-kernel@...r.kernel.org, stable@...r.kernel.org
Cc: Hoi Pok Wu <wuhoipok@...il.com>,
Dave Kleikamp <dave.kleikamp@...cle.com>,
Sasha Levin <sashal@...nel.org>, shaggy@...nel.org,
mudongliangabcd@...il.com, r33s3n6@...il.com, paskripkin@...il.com,
jfs-discussion@...ts.sourceforge.net
Subject: [PATCH AUTOSEL 6.1 04/22] fs: jfs: fix shift-out-of-bounds in dbDiscardAG
From: Hoi Pok Wu <wuhoipok@...il.com>
[ Upstream commit 25e70c6162f207828dd405b432d8f2a98dbf7082 ]
This should be applied to most URSAN bugs found recently by syzbot,
by guarding the dbMount. As syzbot feeding rubbish into the bmap
descriptor.
Signed-off-by: Hoi Pok Wu <wuhoipok@...il.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@...cle.com>
Signed-off-by: Sasha Levin <sashal@...nel.org>
---
fs/jfs/jfs_dmap.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index e1cbfbb60303..765838578a72 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -198,6 +198,11 @@ int dbMount(struct inode *ipbmap)
goto err_release_metapage;
}
+ if (((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) {
+ err = -EINVAL;
+ goto err_release_metapage;
+ }
+
for (i = 0; i < MAXAG; i++)
bmp->db_agfree[i] = le64_to_cpu(dbmp_le->dn_agfree[i]);
bmp->db_agsize = le64_to_cpu(dbmp_le->dn_agsize);
--
2.35.1
Powered by blists - more mailing lists