Commit 5dff41a8 authored by Aditya Dutt's avatar Aditya Dutt Committed by Dave Kleikamp
Browse files

jfs: fix array-index-out-of-bounds read in add_missing_indices 



stbl is s8 but it must contain offsets into slot which can go from 0 to
127.

Added a bound check for that error and return -EIO if the check fails.
Also make jfs_readdir return with error if add_missing_indices returns
with an error.

Reported-by: default avatar <syzbot+b974bd41515f770c608b@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com./bug?extid=b974bd41515f770c608b


Signed-off-by: default avatarAditya Dutt <duttaditya18@gmail.com>
Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
parent a4685408

fs/jfs/jfs_dtree.c

+15 −3
Original line number Diff line number Diff line
@@ -2613,7 +2613,7 @@ void dtInitRoot(tid_t tid, struct inode *ip, u32 idotdot) 
 *	     fsck.jfs should really fix this, but it currently does not.

 *	     Called from jfs_readdir when bad index is detected.

 */

static void add_missing_indices(struct inode *inode, s64 bn)

static int add_missing_indices(struct inode *inode, s64 bn)

{

	struct ldtentry *d;

	struct dt_lock *dtlck;
@@ -2622,7 +2622,7 @@ static void add_missing_indices(struct inode *inode, s64 bn) 
	struct lv *lv;

	struct metapage *mp;

	dtpage_t *p;

	int rc;

	int rc = 0;

	s8 *stbl;

	tid_t tid;

	struct tlock *tlck;
@@ -2647,6 +2647,16 @@ static void add_missing_indices(struct inode *inode, s64 bn) 


	stbl = DT_GETSTBL(p);

	for (i = 0; i < p->header.nextindex; i++) {

		if (stbl[i] < 0) {

			jfs_err("jfs: add_missing_indices: Invalid stbl[%d] = %d for inode %ld, block = %lld",

				i, stbl[i], (long)inode->i_ino, (long long)bn);

			rc = -EIO;



			DT_PUTPAGE(mp);

			txAbort(tid, 0);

			goto end;

		}



		d = (struct ldtentry *) &p->slot[stbl[i]];

		index = le32_to_cpu(d->index);

		if ((index < 2) || (index >= JFS_IP(inode)->next_index)) {
@@ -2664,6 +2674,7 @@ static void add_missing_indices(struct inode *inode, s64 bn) 
	(void) txCommit(tid, 1, &inode, 0);

end:

	txEnd(tid);

	return rc;

}



/*
@@ -3017,7 +3028,8 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) 
		}



		if (fix_page) {

			add_missing_indices(ip, bn);

			if ((rc = add_missing_indices(ip, bn)))

				goto out;

			page_fixed = 1;

		}