[PATCH] jfs: fix kernel paging request bug in dbAllocBits

l1za0.sec
2026-04-20T16:02:42Z

From: Haocheng Yu <l1za0.sec@gmail.com>

A BUG: unable to handle kernel paging request in dbAllocBits issue
is reported by a modified Syzkaller-based kernel fuzzing tool that
we developed.

The issue arises because dbAllocBits() uses bmp->db_agfree[agno],
and agno is used without verification after being calculated using
`blkno >> bmp->db_agl2size;`. And blkno is calculated using
`blkno = le64_to_cpu(dp->start) + (word << L2DBWORD);`. If a
corrupted image is read at runtime, an unreasonable db->start might
be read, causing agno to be excessively large.

To fix this vulnerability, I added the db_valid_agno() helper
function to verify the validity of blkno and agno. This verification
is added before all similar places that use bmp->db_agfree[agno],
including dbAllocBits(), dbFreeBits(), and dbAllocDmapBU().

Signed-off-by: Haocheng Yu <l1za0.sec@gmail.com>
---
fs/jfs/jfs_dmap.c | 36 +++++++++++++++++++++++++++++++++---
1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 88afd108c2dd..5f144dd92336 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -106,6 +106,21 @@ static int dbInitTree(struct dmaptree * dtp);
static int dbInitDmapCtl(struct dmapctl * dcp, int level, int i);
static int dbGetL2AGSize(s64 nblocks);

+static bool db_valid_agno(struct bmap *bmp, s64 blkno, int *agno)
+{
+ int idx;
+
+ if (unlikely(blkno < 0 || blkno >= bmp->db_mapsize))
+ return false;
+
+ idx = blkno >> bmp->db_agl2size;
+ if (unlikely(idx < 0 || idx >= bmp->db_numag || idx >= MAXAG))
+ return false;
+
+ *agno = idx;
+ return true;
+}
+
/*
* buddy table
*
@@ -2235,12 +2250,17 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
le32_add_cpu(&dp->nfree, -nblocks);

BMAP_LOCK(bmp);
+ if (unlikely(!db_valid_agno(bmp, blkno, &agno))) {
+ BMAP_UNLOCK(bmp);
+ jfs_error(bmp->db_ipbmap->i_sb,
+ "invalid agno in %s\n", __func__);
+ return;
+ }

/* if this allocation group is completely free,
* update the maximum allocation group number if this allocation
* group is the new max.
*/
- agno = blkno >> bmp->db_agl2size;
if (agno > bmp->db_maxag)
bmp->db_maxag = agno;

@@ -2383,7 +2403,12 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
/* update the free count for the allocation group and
* map.
*/
- agno = blkno >> bmp->db_agl2size;
+ if (unlikely(!db_valid_agno(bmp, blkno, &agno))) {
+ BMAP_UNLOCK(bmp);
+ jfs_error(bmp->db_ipbmap->i_sb,
+ "invalid agno in %s\n", __func__);
+ return -EIO;
+ }
bmp->db_nfree += nblocks;
bmp->db_agfree[agno] += nblocks;

@@ -3296,7 +3321,12 @@ static int dbAllocDmapBU(struct bmap * bmp, struct dmap * dp, s64 blkno,
* update the highest active allocation group number
* if this allocation group is the new max.
*/
- agno = blkno >> bmp->db_agl2size;
+ if (unlikely(!db_valid_agno(bmp, blkno, &agno))) {
+ BMAP_UNLOCK(bmp);
+ jfs_error(bmp->db_ipbmap->i_sb,
+ "invalid agno in %s\n", __func__);
+ return -EIO;
+ }
if (agno > bmp->db_maxag)
bmp->db_maxag = agno;

base-commit: ffc253263a1375a65fa6c9f62a893e9767fbebfa
--
2.51.0