jfs: fix array-index-out-of-bounds in dbFindLeaf
stable inclusion from stable-v4.19.299 commit 86df90f3fea7c5591f05c8a0010871d435e83046 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9REBH CVE: CVE-2023-52799 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=tags/v4.19.300&id=86df90f3fea7c5591f05c8a0010871d435e83046 -------------------------------- [ Upstream commit 22cad8bc1d36547cdae0eef316c47d917ce3147c ] Currently while searching for dmtree_t for sufficient free blocks there is an array out of bounds while getting element in tp->dm_stree. To add the required check for out of bound we first need to determine the type of dmtree. Thus added an extra parameter to dbFindLeaf so that the type of tree can be determined and the required check can be applied. Reported-by:<syzbot+aea1ad91e854d0a83e04@syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=aea1ad91e854d0a83e04 Signed-off-by:
Manas Ghandat <ghandatmanas@gmail.com> Signed-off-by:
Dave Kleikamp <dave.kleikamp@oracle.com> Signed-off-by:
Sasha Levin <sashal@kernel.org> Signed-off-by:
Long Li <leo.lilong@huawei.com>
Loading
Please sign in to comment