Messages in this thread | | | Date | Wed, 4 Oct 2023 09:23:36 -0500 | Subject | Re: [PATCH v2] jfs: fix array-index-out-of-bounds in diAlloc | From | Dave Kleikamp <> |
| |
On 10/4/23 2:40AM, Manas Ghandat wrote: > Currently there is not check against the agno of the iag while > allocating new inodes to avoid fragmentation problem. Added the check > which is required.
Applied to jfs-next
Thanks, Shaggy
> > Reported-by: syzbot+79d792676d8ac050949f@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=79d792676d8ac050949f > Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com> > --- > V1 -> V2 : Added check for higher bound of agno > fs/jfs/jfs_imap.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c > index 799d3837e7c2..c0cf74e7392b 100644 > --- a/fs/jfs/jfs_imap.c > +++ b/fs/jfs/jfs_imap.c > @@ -1319,7 +1319,7 @@ diInitInode(struct inode *ip, int iagno, int ino, int extno, struct iag * iagp) > int diAlloc(struct inode *pip, bool dir, struct inode *ip) > { > int rc, ino, iagno, addext, extno, bitno, sword; > - int nwords, rem, i, agno; > + int nwords, rem, i, agno, dn_numag; > u32 mask, inosmap, extsmap; > struct inode *ipimap; > struct metapage *mp; > @@ -1355,6 +1355,9 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip) > > /* get the ag number of this iag */ > agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb)); > + dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag; > + if (agno < 0 || agno > dn_numag) > + return -EIO; > > if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) { > /*
| |