linux-kernel - [PATCH] jfs: add linelock->index boundary check in diWrite

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251109080113.236739-1-yun.zhou@windriver.com>
Date: Sun, 9 Nov 2025 16:01:13 +0800
From: Yun Zhou <yun.zhou@...driver.com>
To: <shaggy@...nel.org>, <akpm@...ux-foundation.org>, <david@...hat.com>,
        <byungchul@...com>, <gregkh@...uxfoundation.org>,
        <yun.zhou@...driver.com>, <shivankg@....com>,
        <ssrane_b23@...vjti.ac.in>
CC: <jfs-discussion@...ts.sourceforge.net>, <linux-kernel@...r.kernel.org>
Subject: [PATCH] jfs: add linelock->index boundary check in diWrite

This patch adds boundary checks for the dilinelock->index in the
diWrite() function of JFS to prevent out-of-bounds access to the lv
array. When dilinelock->index exceeds dilinelock->maxcnt, it calls
txLinelock() to refresh the dilinelock structure, ensuring valid access
to dilinelock->lv[] during inode data writing.

Reported-by: syzbot+9489c9f9f3d437221ea2@...kaller.appspotmail.com
Signed-off-by: Yun Zhou <yun.zhou@...driver.com>
---
 fs/jfs/jfs_imap.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index ecb8e05b8b84..7f93150d319f 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -762,6 +762,8 @@ int diWrite(tid_t tid, struct inode *ip)
 	 * copy inline symlink from in-memory inode to on-disk inode
 	 */
 	if (S_ISLNK(ip->i_mode) && ip->i_size < IDATASIZE) {
+		if (unlikely(dilinelock->index >= dilinelock->maxcnt))
+			dilinelock = txLinelock(dilinelock);
 		lv = & dilinelock->lv[dilinelock->index];
 		lv->offset = (dioffset + 2 * 128) >> L2INODESLOTSIZE;
 		lv->length = 2;
@@ -773,6 +775,8 @@ int diWrite(tid_t tid, struct inode *ip)
 	 * 128 byte slot granularity
 	 */
 	if (test_cflag(COMMIT_Inlineea, ip)) {
+		if (unlikely(dilinelock->index >= dilinelock->maxcnt))
+			dilinelock = txLinelock(dilinelock);
 		lv = & dilinelock->lv[dilinelock->index];
 		lv->offset = (dioffset + 3 * 128) >> L2INODESLOTSIZE;
 		lv->length = 1;
@@ -785,6 +789,8 @@ int diWrite(tid_t tid, struct inode *ip)
 	/*
 	 *	lock/copy inode base: 128 byte slot granularity
 	 */
+	if (unlikely(dilinelock->index >= dilinelock->maxcnt))
+		dilinelock = txLinelock(dilinelock);
 	lv = & dilinelock->lv[dilinelock->index];
 	lv->offset = dioffset >> L2INODESLOTSIZE;
 	copy_to_dinode(dp, ip);
-- 
2.34.1