linux-kernel - [PATCH] jfs: fix array-index-out-of-bounds in diExtendFS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260122012541.1927-2-qikeyu2017@gmail.com>
Date: Thu, 22 Jan 2026 09:25:42 +0800
From: Kery Qi <qikeyu2017@...il.com>
To: shaggy@...nel.org
Cc: dmantipov@...dex.ru,
	eadavis@...com,
	quic_zhonhan@...cinc.com,
	jfs-discussion@...ts.sourceforge.net,
	linux-kernel@...r.kernel.org,
	Kery Qi <qikeyu2017@...il.com>
Subject: [PATCH] jfs: fix array-index-out-of-bounds in diExtendFS

Similar to the issue fixed in commit 49f9637aafa6 ("jfs: fix
array-index-out-of-bounds in diNewExt"), the diExtendFS() function
also lacks validation for the AG (allocation group) number.

In diExtendFS(), the variable 'n' is computed from iagp->agstart
which is read from disk. If agstart contains a malicious or corrupted
value, 'n' may exceed the bounds of the im_agctl[] array (size MAXAG),
leading to an out-of-bounds access.

Add a boundary check for 'n' after computation to ensure it falls
within the valid range [0, MAXAG). If the check fails, release the
metapage and return -EIO.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kery Qi <qikeyu2017@...il.com>
---
 fs/jfs/jfs_imap.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index ecb8e05b8b84..24b414bffd29 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -2900,6 +2900,11 @@ int diExtendFS(struct inode *ipimap, struct inode *ipbmap)

 		agstart = le64_to_cpu(iagp->agstart);
 		n = agstart >> mp->db_agl2size;
+		if (n < 0 || n >= MAXAG) {
+			release_metapage(bp);
+			jfs_error(ipimap->i_sb, "invalid AG number\n");
+			return -EIO;
+		}
 		iagp->agstart = cpu_to_le64((s64)n << mp->db_agl2size);

 		/* compute backed inodes */
-- 
2.34.1