Forwarded: Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbJoin (2)

[syzbot <syzbot+fa603ae6b02658401ca7@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [jfs?] UBSAN: shift-out-of-bounds in dbJoin (2)
Author: tristmd@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -2770,6 +2770,10 @@ static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl)
 	int budsz, buddy;
 	s8 *leaf;
 
+	if (newval < 0 ||
+	    (newval >= tp->dmt_budmin && newval - tp->dmt_budmin >= 32))
+		return -EIO;
+
 	/* can the new leaf value require a join with other leaves ?
 	 */
 	if (newval >= tp->dmt_budmin) {