summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorManas Ghandat <ghandatmanas@gmail.com>2023-10-04 09:40:40 +0200
committerDave Kleikamp <dave.kleikamp@oracle.com>2023-10-04 16:18:03 +0200
commit05d9ea1ceb62a55af6727a69269a4fd310edf483 (patch)
tree7ddef40066c70bc93e0d0acf214df04b56e1d859
parentjfs: fix array-index-out-of-bounds in dbFindLeaf (diff)
downloadlinux-05d9ea1ceb62a55af6727a69269a4fd310edf483.tar.xz
linux-05d9ea1ceb62a55af6727a69269a4fd310edf483.zip
jfs: fix array-index-out-of-bounds in diAlloc
Currently there is not check against the agno of the iag while allocating new inodes to avoid fragmentation problem. Added the check which is required. Reported-by: syzbot+79d792676d8ac050949f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=79d792676d8ac050949f Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
-rw-r--r--fs/jfs/jfs_imap.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 923a58422c46..1b267eec3f36 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -1320,7 +1320,7 @@ diInitInode(struct inode *ip, int iagno, int ino, int extno, struct iag * iagp)
int diAlloc(struct inode *pip, bool dir, struct inode *ip)
{
int rc, ino, iagno, addext, extno, bitno, sword;
- int nwords, rem, i, agno;
+ int nwords, rem, i, agno, dn_numag;
u32 mask, inosmap, extsmap;
struct inode *ipimap;
struct metapage *mp;
@@ -1356,6 +1356,9 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
/* get the ag number of this iag */
agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
+ dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
+ if (agno < 0 || agno > dn_numag)
+ return -EIO;
if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
/*