From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Manas Ghandat <ghandatmanas@gmail.com>,
syzbot+79d792676d8ac050949f@syzkaller.appspotmail.com,
Dave Kleikamp <dave.kleikamp@oracle.com>,
Sasha Levin <sashal@kernel.org>,
shaggy@kernel.org, jlayton@kernel.org, brauner@kernel.org,
liushixin2@huawei.com, jfs-discussion@lists.sourceforge.net,
okanatov@gmail.com
Subject: [PATCH AUTOSEL 5.15 09/22] jfs: fix array-index-out-of-bounds in diAlloc
Date: Tue, 7 Nov 2023 10:51:18 -0500 [thread overview]
Message-ID: <20231107155146.3767610-9-sashal@kernel.org> (raw)
In-Reply-To: <20231107155146.3767610-1-sashal@kernel.org>
From: Manas Ghandat <ghandatmanas@gmail.com>
[ Upstream commit 05d9ea1ceb62a55af6727a69269a4fd310edf483 ]
Currently there is not check against the agno of the iag while
allocating new inodes to avoid fragmentation problem. Added the check
which is required.
Reported-by: syzbot+79d792676d8ac050949f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=79d792676d8ac050949f
Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/jfs_imap.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 4899663996d81..6ed2e1d4c894f 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -1320,7 +1320,7 @@ diInitInode(struct inode *ip, int iagno, int ino, int extno, struct iag * iagp)
int diAlloc(struct inode *pip, bool dir, struct inode *ip)
{
int rc, ino, iagno, addext, extno, bitno, sword;
- int nwords, rem, i, agno;
+ int nwords, rem, i, agno, dn_numag;
u32 mask, inosmap, extsmap;
struct inode *ipimap;
struct metapage *mp;
@@ -1356,6 +1356,9 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
/* get the ag number of this iag */
agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
+ dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
+ if (agno < 0 || agno > dn_numag)
+ return -EIO;
if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
/*
--
2.42.0
next prev parent reply other threads:[~2023-11-07 16:10 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-07 15:51 [PATCH AUTOSEL 5.15 01/22] ASoC: soc-card: Add storage for PCI SSID Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 02/22] crypto: pcrypt - Fix hungtask for PADATA_RESET Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 03/22] RDMA/hfi1: Use FIELD_GET() to extract Link Width Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 04/22] scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 05/22] scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 06/22] fs/jfs: Add check for negative db_l2nbperpage Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 07/22] fs/jfs: Add validity check for db_maxag and db_agpref Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 08/22] jfs: fix array-index-out-of-bounds in dbFindLeaf Sasha Levin
2023-11-07 15:51 ` Sasha Levin [this message]
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 10/22] HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 11/22] ARM: 9320/1: fix stack depot IRQ stack filter Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 12/22] ALSA: hda: Fix possible null-ptr-deref when assigning a stream Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 13/22] PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 14/22] atm: iphase: Do PCI error checks on own line Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 15/22] scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 16/22] PCI: Use FIELD_GET() to extract Link Width Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 17/22] PCI: Extract ATS disabling to a helper function Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 18/22] PCI: Disable ATS for specific Intel IPU E2000 devices Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 19/22] misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 20/22] PCI: Use FIELD_GET() in Sapphire RX 5600 XT Pulse quirk Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 21/22] HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W Sasha Levin
2023-11-07 15:51 ` [PATCH AUTOSEL 5.15 22/22] exfat: support handle zero-size directory Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231107155146.3767610-9-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=brauner@kernel.org \
--cc=dave.kleikamp@oracle.com \
--cc=ghandatmanas@gmail.com \
--cc=jfs-discussion@lists.sourceforge.net \
--cc=jlayton@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=liushixin2@huawei.com \
--cc=okanatov@gmail.com \
--cc=shaggy@kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+79d792676d8ac050949f@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox