All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Manas Ghandat <ghandatmanas@gmail.com>,
	kernel test robot <lkp@intel.com>,
	Dan Carpenter <dan.carpenter@linaro.org>,
	Dave Kleikamp <dave.kleikamp@oracle.com>,
	Sasha Levin <sashal@kernel.org>,
	shaggy@kernel.org, osmtendev@gmail.com,
	jfs-discussion@lists.sourceforge.net
Subject: [PATCH AUTOSEL 4.19 03/12] jfs: fix slab-out-of-bounds Read in dtSearch
Date: Mon, 15 Jan 2024 19:27:56 -0500	[thread overview]
Message-ID: <20240116002817.216837-3-sashal@kernel.org> (raw)
In-Reply-To: <20240116002817.216837-1-sashal@kernel.org>

From: Manas Ghandat <ghandatmanas@gmail.com>

[ Upstream commit fa5492ee89463a7590a1449358002ff7ef63529f ]

Currently while searching for current page in the sorted entry table
of the page there is a out of bound access. Added a bound check to fix
the error.

Dave:
Set return code to -EIO

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202310241724.Ed02yUz9-lkp@intel.com/
Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_dtree.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 320c9f42b65b..ea2c8f0fe832 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -646,6 +646,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
 		for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) {
 			index = base + (lim >> 1);
 
+			if (stbl[index] < 0) {
+				rc = -EIO;
+				goto out;
+			}
+
 			if (p->header.flag & BT_LEAF) {
 				/* uppercase leaf name to compare */
 				cmp =
-- 
2.43.0


  parent reply	other threads:[~2024-01-16  0:28 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-01-16  0:27 [PATCH AUTOSEL 4.19 01/12] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree Sasha Levin
2024-01-16  0:27 ` [PATCH AUTOSEL 4.19 02/12] UBSAN: array-index-out-of-bounds in dtSplitRoot Sasha Levin
2024-01-16  0:27 ` Sasha Levin [this message]
2024-01-16  0:27 ` [PATCH AUTOSEL 4.19 04/12] jfs: fix array-index-out-of-bounds in dbAdjTree Sasha Levin
2024-01-16  0:27 ` [PATCH AUTOSEL 4.19 05/12] jfs: fix uaf in jfs_evict_inode Sasha Levin
2024-01-16  0:27 ` [PATCH AUTOSEL 4.19 06/12] jfs: fix shift-out-of-bounds in dbJoin Sasha Levin
2024-01-16  0:28 ` [PATCH AUTOSEL 4.19 07/12] pstore/ram: Fix crash when setting number of cpus to an odd number Sasha Levin
2024-01-16  0:28   ` Sasha Levin
2024-01-16  0:28 ` [PATCH AUTOSEL 4.19 08/12] crypto: stm32/crc32 - fix parsing list of devices Sasha Levin
2024-01-16  0:28   ` Sasha Levin
2024-01-16  0:28 ` [PATCH AUTOSEL 4.19 09/12] afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*() Sasha Levin
2024-01-16  0:28 ` [PATCH AUTOSEL 4.19 10/12] rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() Sasha Levin
2024-01-16  0:28 ` [PATCH AUTOSEL 4.19 11/12] gfs2: Refcounting fix in gfs2_thaw_super Sasha Levin
2024-01-16 20:46   ` Pavel Machek
2024-01-18 11:50     ` Andreas Gruenbacher
2024-01-30 21:16       ` Sasha Levin
2024-01-16  0:28 ` [PATCH AUTOSEL 4.19 12/12] jfs: fix array-index-out-of-bounds in diNewExt Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240116002817.216837-3-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=dan.carpenter@linaro.org \
    --cc=dave.kleikamp@oracle.com \
    --cc=ghandatmanas@gmail.com \
    --cc=jfs-discussion@lists.sourceforge.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lkp@intel.com \
    --cc=osmtendev@gmail.com \
    --cc=shaggy@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.