Unverified Commit 059a9aa2 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12429 jfs: Fix uaf in dbFreeBits 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yifan Qiao <qiaoyifan4@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ANZNAXOHKZXVW5E2PJRX33K3HMGEXE43/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYRCC 
 
Link:https://gitee.com/openeuler/kernel/pulls/12429

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 86987d26 b329697f

fs/jfs/jfs_discard.c

+9 −2
Original line number Diff line number Diff line
@@ -65,7 +65,7 @@ void jfs_issue_discard(struct inode *ip, u64 blkno, u64 nblocks) 
int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)

{

	struct inode *ipbmap = JFS_SBI(ip->i_sb)->ipbmap;

	struct bmap *bmp = JFS_SBI(ip->i_sb)->bmap;

	struct bmap *bmp;

	struct super_block *sb = ipbmap->i_sb;

	int agno, agno_end;

	u64 start, end, minlen;
@@ -83,10 +83,15 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range) 
	if (minlen == 0)

		minlen = 1;



	down_read(&sb->s_umount);

	bmp = JFS_SBI(ip->i_sb)->bmap;



	if (minlen > bmp->db_agsize ||

	    start >= bmp->db_mapsize ||

	    range->len < sb->s_blocksize)

	    range->len < sb->s_blocksize) {

		up_read(&sb->s_umount);

		return -EINVAL;

	}



	if (end >= bmp->db_mapsize)

		end = bmp->db_mapsize - 1;
@@ -100,6 +105,8 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range) 
		trimmed += dbDiscardAG(ip, agno, minlen);

		agno++;

	}



	up_read(&sb->s_umount);

	range->len = trimmed << sb->s_blocksize_bits;



	return 0;