Commit 25e70c61 authored by Hoi Pok Wu's avatar Hoi Pok Wu Committed by Dave Kleikamp
Browse files

fs: jfs: fix shift-out-of-bounds in dbDiscardAG 



This should be applied to most URSAN bugs found recently by syzbot,
by guarding the dbMount. As syzbot feeding rubbish into the bmap
descriptor.

Signed-off-by: default avatarHoi Pok Wu <wuhoipok@gmail.com>
Signed-off-by: default avatarDave Kleikamp <dave.kleikamp@oracle.com>
parent ebe06036

fs/jfs/jfs_dmap.c

+5 −0
Original line number Diff line number Diff line
@@ -198,6 +198,11 @@ int dbMount(struct inode *ipbmap) 
		goto err_release_metapage;

	}



	if (((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) {

		err = -EINVAL;

		goto err_release_metapage;

	}



	for (i = 0; i < MAXAG; i++)

		bmp->db_agfree[i] = le64_to_cpu(dbmp_le->dn_agfree[i]);

	bmp->db_agsize = le64_to_cpu(dbmp_le->dn_agsize);