Commit c2140068 authored by Arnaud Lecomte's avatar Arnaud Lecomte Committed by Dave Kleikamp
Browse files

jfs: upper bound check of tree index in dbAllocAG 



When computing the tree index in dbAllocAG, we never check if we are
out of bounds realative to the size of the stree.
This could happen in a scenario where the filesystem metadata are
corrupted.

Reported-by: default avatar <syzbot+cffd18309153948f3c3e@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=cffd18309153948f3c3e


Tested-by: default avatar <syzbot+cffd18309153948f3c3e@syzkaller.appspotmail.com>
Signed-off-by: default avatarArnaud Lecomte <contact@arnaud-lcm.com>
Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
parent bc9ff192

fs/jfs/jfs_dmap.c

+6 −0
Original line number Diff line number Diff line
@@ -1389,6 +1389,12 @@ dbAllocAG(struct bmap * bmp, int agno, s64 nblocks, int l2nb, s64 * results) 
	    (1 << (L2LPERCTL - (bmp->db_agheight << 1))) / bmp->db_agwidth;

	ti = bmp->db_agstart + bmp->db_agwidth * (agno & (agperlev - 1));



	if (ti < 0 || ti >= le32_to_cpu(dcp->nleafs)) {

		jfs_error(bmp->db_ipbmap->i_sb, "Corrupt dmapctl page\n");

		release_metapage(mp);

		return -EIO;

	}



	/* dmap control page trees fan-out by 4 and a single allocation

	 * group may be described by 1 or 2 subtrees within the ag level

	 * dmap control page, depending upon the ag size. examine the ag's