ef5c205b6e
commit 11509910c599cbd04585ec35a6d5e1a0053d84c1 upstream. In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting. Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181. Thus, make sure that db_l2nbperpage is correct while mounting. Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size) => Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE Reported-and-tested-by: syzbot+d2cd27dcf8e04b232eb2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=2a70a453331db32ed491f5cbb07e81bf2d225715 Cc: stable@vger.kernel.org Suggested-by: Dave Kleikamp <dave.kleikamp@oracle.com> Signed-off-by: Siddh Raman Pant <code@siddh.me> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
acl.c | ||
file.c | ||
inode.c | ||
ioctl.c | ||
jfs_acl.h | ||
jfs_btree.h | ||
jfs_debug.c | ||
jfs_debug.h | ||
jfs_dinode.h | ||
jfs_discard.c | ||
jfs_discard.h | ||
jfs_dmap.c | ||
jfs_dmap.h | ||
jfs_dtree.c | ||
jfs_dtree.h | ||
jfs_extent.c | ||
jfs_extent.h | ||
jfs_filsys.h | ||
jfs_imap.c | ||
jfs_imap.h | ||
jfs_incore.h | ||
jfs_inode.c | ||
jfs_inode.h | ||
jfs_lock.h | ||
jfs_logmgr.c | ||
jfs_logmgr.h | ||
jfs_metapage.c | ||
jfs_metapage.h | ||
jfs_mount.c | ||
jfs_superblock.h | ||
jfs_txnmgr.c | ||
jfs_txnmgr.h | ||
jfs_types.h | ||
jfs_umount.c | ||
jfs_unicode.c | ||
jfs_unicode.h | ||
jfs_uniupr.c | ||
jfs_xattr.h | ||
jfs_xtree.c | ||
jfs_xtree.h | ||
Kconfig | ||
Makefile | ||
namei.c | ||
resize.c | ||
super.c | ||
symlink.c | ||
xattr.c |