linux-kernel - [PATCH] jfs: fix array-index-out-of-bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240922110000.128650-1-ghanshyam1898@gmail.com>
Date: Sun, 22 Sep 2024 16:30:00 +0530
From: Ghanshyam Agrawal <ghanshyam1898@...il.com>
To: shaggy@...nel.org,
	ghandatmanas@...il.com,
	jlayton@...nel.org,
	eadavis@...com,
	brauner@...nel.org,
	ghanshyam1898@...il.com
Cc: jfs-discussion@...ts.sourceforge.net,
	linux-kernel@...r.kernel.org,
	syzbot+808f3f84407f08a93022@...kaller.appspotmail.com
Subject: [PATCH] jfs: fix array-index-out-of-bounds

In some cases, dn_numag may be greater than MAXAG which may
result in an array-index-out-of-bounds in dbNextAG. Added
a check to return an error code before we crash.

Reported-by: syzbot+808f3f84407f08a93022@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=808f3f84407f08a93022
Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@...il.com>
---
 fs/jfs/jfs_imap.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 2ec35889ad24..5088da13e8f1 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -1360,6 +1360,9 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
 	if (agno < 0 || agno > dn_numag)
 		return -EIO;
 
+	if (unlikely(dn_numag > MAXAG))
+		return -EIO;
+
 	if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
 		/*
 		 * There is an open file actively growing.  We want to
-- 
2.34.1