Commit 1cbf99e4 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'jfs-6.16' of github.com:kleikamp/linux-shaggy 

Pull jfs updates from David Kleikamp:
 "A few small fixes for jfs"

* tag 'jfs-6.16' of github.com:kleikamp/linux-shaggy:
  jfs: fix array-index-out-of-bounds read in add_missing_indices
  jfs: Fix null-ptr-deref in jfs_ioc_trim
  jfs: validate AG parameters in dbMount() to prevent crashes
parents b1fd8bd0 5dff41a8

fs/jfs/jfs_discard.c

+2 −1
Original line number Diff line number Diff line
@@ -86,7 +86,8 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range) 
	down_read(&sb->s_umount);

	bmp = JFS_SBI(ip->i_sb)->bmap;



	if (minlen > bmp->db_agsize ||

	if (bmp == NULL ||

	    minlen > bmp->db_agsize ||

	    start >= bmp->db_mapsize ||

	    range->len < sb->s_blocksize) {

		up_read(&sb->s_umount);

fs/jfs/jfs_dmap.c

+5 −1
Original line number Diff line number Diff line
@@ -194,7 +194,11 @@ int dbMount(struct inode *ipbmap) 
	    !bmp->db_numag || (bmp->db_numag > MAXAG) ||

	    (bmp->db_maxag >= MAXAG) || (bmp->db_maxag < 0) ||

	    (bmp->db_agpref >= MAXAG) || (bmp->db_agpref < 0) ||

	    !bmp->db_agwidth ||

	    (bmp->db_agheight < 0) || (bmp->db_agheight > (L2LPERCTL >> 1)) ||

	    (bmp->db_agwidth < 1) || (bmp->db_agwidth > (LPERCTL / MAXAG)) ||

	    (bmp->db_agwidth > (1 << (L2LPERCTL - (bmp->db_agheight << 1)))) ||

	    (bmp->db_agstart < 0) ||

	    (bmp->db_agstart > (CTLTREESIZE - 1 - bmp->db_agwidth * (MAXAG - 1))) ||

	    (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG) ||

	    (bmp->db_agl2size < 0) ||

	    ((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) {

fs/jfs/jfs_dtree.c

+15 −3
Original line number Diff line number Diff line
@@ -2613,7 +2613,7 @@ void dtInitRoot(tid_t tid, struct inode *ip, u32 idotdot) 
 *	     fsck.jfs should really fix this, but it currently does not.

 *	     Called from jfs_readdir when bad index is detected.

 */

static void add_missing_indices(struct inode *inode, s64 bn)

static int add_missing_indices(struct inode *inode, s64 bn)

{

	struct ldtentry *d;

	struct dt_lock *dtlck;
@@ -2622,7 +2622,7 @@ static void add_missing_indices(struct inode *inode, s64 bn) 
	struct lv *lv;

	struct metapage *mp;

	dtpage_t *p;

	int rc;

	int rc = 0;

	s8 *stbl;

	tid_t tid;

	struct tlock *tlck;
@@ -2647,6 +2647,16 @@ static void add_missing_indices(struct inode *inode, s64 bn) 


	stbl = DT_GETSTBL(p);

	for (i = 0; i < p->header.nextindex; i++) {

		if (stbl[i] < 0) {

			jfs_err("jfs: add_missing_indices: Invalid stbl[%d] = %d for inode %ld, block = %lld",

				i, stbl[i], (long)inode->i_ino, (long long)bn);

			rc = -EIO;



			DT_PUTPAGE(mp);

			txAbort(tid, 0);

			goto end;

		}



		d = (struct ldtentry *) &p->slot[stbl[i]];

		index = le32_to_cpu(d->index);

		if ((index < 2) || (index >= JFS_IP(inode)->next_index)) {
@@ -2664,6 +2674,7 @@ static void add_missing_indices(struct inode *inode, s64 bn) 
	(void) txCommit(tid, 1, &inode, 0);

end:

	txEnd(tid);

	return rc;

}



/*
@@ -3017,7 +3028,8 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) 
		}



		if (fix_page) {

			add_missing_indices(ip, bn);

			if ((rc = add_missing_indices(ip, bn)))

				goto out;

			page_fixed = 1;

		}