linux-kernel - Forwarded: Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dtDelete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <68cd758a.050a0220.13cd81.0002.GAE@google.com>
Date: Fri, 19 Sep 2025 08:23:54 -0700
From: syzbot <syzbot+4f9c823a6f63d87491ba@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org
Subject: Forwarded: Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dtDelete

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dtDelete
Author: pedrodemargomes@...il.com

#syz test


---
 fs/jfs/jfs_dtree.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index ab11849cf9cc..c200b37f4562 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -2129,11 +2129,17 @@ int dtDelete(tid_t tid,
  next_index = -1;
  else {
  stbl = DT_GETSTBL(np);
- ldtentry =
-     (struct ldtentry *) & np->
-     slot[stbl[0]];
- next_index =
-     le32_to_cpu(ldtentry->index);
+ if (stbl[0] < 0 || stbl[0] >= DTPAGEMAXSLOT) {
+ jfs_err("JFS: Invalid stbl[0] = %d for inode %ld, block = %lld",
+ stbl[0], (long)ip->i_ino, (long long)le64_to_cpu(p->header.next));
+ next_index = -1;
+ } else {
+ ldtentry =
+ (struct ldtentry *) & np->
+ slot[stbl[0]];
+ next_index =
+ le32_to_cpu(ldtentry->index);
+ }
  DT_PUTPAGE(nmp);
  }
  }
-- 
2.43.0

-- 
You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@...glegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/825ad453-7347-4af7-8a14-3aaf678c83a6n%40googlegroups.com.