Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

jfs: Fix array-index-out-of-bounds in diFree

Browse source 
[ Upstream commit f73f969b2eb39ad8056f6c7f3a295fa2f85e313a ]

Reported-by: syzbot+241c815bda521982cb49@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Jeongjun Park 2024-05-30 22:28:09 +09:00 • committed by Ksawlii
parent cea8877ea0
commit c48b0762c0
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
fs/jfs/jfs_imap.c
View file

@ -292,7 +292,7 @@ int diSync(struct inode *ipimap)
int diRead(struct inode *ip) int diRead(struct inode *ip)
{ {
struct jfs_sb_info *sbi = JFS_SBI(ip->i_sb); struct jfs_sb_info *sbi = JFS_SBI(ip->i_sb);
int iagno, ino, extno, rc; int iagno, ino, extno, rc, agno;
struct inode *ipimap; struct inode *ipimap;
struct dinode *dp; struct dinode *dp;
struct iag *iagp; struct iag *iagp;
@ -341,8 +341,11 @@ int diRead(struct inode *ip)
/* get the ag for the iag */ /* get the ag for the iag */
agstart = le64_to_cpu(iagp->agstart); agstart = le64_to_cpu(iagp->agstart);
agno = BLKTOAG(agstart, JFS_SBI(ip->i_sb));
release_metapage(mp); release_metapage(mp);
if (agno >= MAXAG || agno < 0)
return -EIO;
rel_inode = (ino & (INOSPERPAGE - 1)); rel_inode = (ino & (INOSPERPAGE - 1));
pageno = blkno >> sbi->l2nbperpage; pageno = blkno >> sbi->l2nbperpage;