[PATCH] jfs: fix kernel paging request bug in dbAllocBits

[l1za0.sec@gmail.com]

From: Haocheng Yu <l1za0.sec@gmail.com>

A BUG: unable to handle kernel paging request in dbAllocBits issue
is reported by a modified Syzkaller-based kernel fuzzing tool that
we developed.

The issue arises because dbAllocBits() uses bmp->db_agfree[agno],
and agno is used without verification after being calculated using
`blkno >> bmp->db_agl2size;`. And blkno is calculated using
`blkno = le64_to_cpu(dp->start) + (word << L2DBWORD);`. If a
corrupted image is read at runtime, an unreasonable db->start might
be read, causing agno to be excessively large.

To fix this vulnerability, I added the db_valid_agno() helper
function to verify the validity of blkno and agno. This verification
is added before all similar places that use bmp->db_agfree[agno],
including dbAllocBits(), dbFreeBits(), and dbAllocDmapBU().

Signed-off-by: Haocheng Yu <l1za0.sec@gmail.com>
---
 fs/jfs/jfs_dmap.c | 36 +++++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 88afd108c2dd..5f144dd92336 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -106,6 +106,21 @@ static int dbInitTree(struct dmaptree * dtp);
 static int dbInitDmapCtl(struct dmapctl * dcp, int level, int i);
 static int dbGetL2AGSize(s64 nblocks);
 
+static bool db_valid_agno(struct bmap *bmp, s64 blkno, int *agno)
+{
+	int idx;
+
+	if (unlikely(blkno < 0 || blkno >= bmp->db_mapsize))
+		return false;
+
+	idx = blkno >> bmp->db_agl2size;
+	if (unlikely(idx < 0 || idx >= bmp->db_numag || idx >= MAXAG))
+		return false;
+
+	*agno = idx;
+	return true;
+}
+
 /*
  *	buddy table
  *
@@ -2235,12 +2250,17 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
 	le32_add_cpu(&dp->nfree, -nblocks);
 
 	BMAP_LOCK(bmp);
+	if (unlikely(!db_valid_agno(bmp, blkno, &agno))) {
+		BMAP_UNLOCK(bmp);
+		jfs_error(bmp->db_ipbmap->i_sb,
+			  "invalid agno in %s\n", __func__);
+		return;
+	}
 
 	/* if this allocation group is completely free,
 	 * update the maximum allocation group number if this allocation
 	 * group is the new max.
 	 */
-	agno = blkno >> bmp->db_agl2size;
 	if (agno > bmp->db_maxag)
 		bmp->db_maxag = agno;
 
@@ -2383,7 +2403,12 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
 	/* update the free count for the allocation group and
 	 * map.
 	 */
-	agno = blkno >> bmp->db_agl2size;
+	if (unlikely(!db_valid_agno(bmp, blkno, &agno))) {
+		BMAP_UNLOCK(bmp);
+		jfs_error(bmp->db_ipbmap->i_sb,
+			  "invalid agno in %s\n", __func__);
+		return -EIO;
+	}
 	bmp->db_nfree += nblocks;
 	bmp->db_agfree[agno] += nblocks;
 
@@ -3296,7 +3321,12 @@ static int dbAllocDmapBU(struct bmap * bmp, struct dmap * dp, s64 blkno,
 	 * update the highest active allocation group number
 	 * if this allocation group is the new max.
 	 */
-	agno = blkno >> bmp->db_agl2size;
+	if (unlikely(!db_valid_agno(bmp, blkno, &agno))) {
+		BMAP_UNLOCK(bmp);
+		jfs_error(bmp->db_ipbmap->i_sb,
+			  "invalid agno in %s\n", __func__);
+		return -EIO;
+	}
 	if (agno > bmp->db_maxag)
 		bmp->db_maxag = agno;
 

base-commit: ffc253263a1375a65fa6c9f62a893e9767fbebfa
-- 
2.51.0