linux-kernel - Re: [PATCH] jfs: fix out-of-bounds in dbNextAG() and diAlloc()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d9e728ce-2517-489e-b86b-7c33ee44a364@oracle.com>
Date: Fri, 23 Aug 2024 14:18:35 -0500
From: Dave Kleikamp <dave.kleikamp@...cle.com>
To: Jeongjun Park <aha310510@...il.com>
Cc: jfs-discussion@...ts.sourceforge.net, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] jfs: fix out-of-bounds in dbNextAG() and diAlloc()

On 8/18/24 11:05PM, Jeongjun Park wrote:
> In dbNextAG() , there is no check for the case where bmp->db_numag is
> greater or same than MAXAG due to a polluted image, which causes an
> out-of-bounds. Therefore, a bounds check should be added in dbMount().
> 
> And in dbNextAG(), a check for the case where agpref is greater than
> bmp->db_numag should be added, so an out-of-bounds exception should be
> prevented.
> 
> Additionally, a check for the case where agno is greater or same than
> MAXAG should be added in diAlloc() to prevent out-of-bounds.

Looks good. Applied.

Shaggy

> 
> Reported-by: Jeongjun Park <aha310510@...il.com>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Jeongjun Park <aha310510@...il.com>
> ---
>   fs/jfs/jfs_dmap.c | 4 ++--
>   fs/jfs/jfs_imap.c | 2 +-
>   2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index 5713994328cb..0625d1c0d064 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -187,7 +187,7 @@ int dbMount(struct inode *ipbmap)
>   	}
>   
>   	bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
> -	if (!bmp->db_numag) {
> +	if (!bmp->db_numag || bmp->db_numag >= MAXAG) {
>   		err = -EINVAL;
>   		goto err_release_metapage;
>   	}
> @@ -652,7 +652,7 @@ int dbNextAG(struct inode *ipbmap)
>   	 * average free space.
>   	 */
>   	for (i = 0 ; i < bmp->db_numag; i++, agpref++) {
> -		if (agpref == bmp->db_numag)
> +		if (agpref >= bmp->db_numag)
>   			agpref = 0;
>   
>   		if (atomic_read(&bmp->db_active[agpref]))
> diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
> index 1407feccbc2d..a360b24ed320 100644
> --- a/fs/jfs/jfs_imap.c
> +++ b/fs/jfs/jfs_imap.c
> @@ -1360,7 +1360,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
>   	/* get the ag number of this iag */
>   	agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
>   	dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
> -	if (agno < 0 || agno > dn_numag)
> +	if (agno < 0 || agno > dn_numag || agno >= MAXAG)
>   		return -EIO;
>   
>   	if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
> --