Messages in this thread Patch in this message | ![/](/images/icornerl.gif) | | From | Jeongjun Park <> | Subject | Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diFree | Date | Thu, 25 Apr 2024 12:15:58 +0900 |
| |
please test array-index-out-of-bounds in diFree
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master
--- fs/jfs/jfs_dmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index cb3cda1390ad..773b9263e497 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -206,6 +206,7 @@ int dbMount(struct inode *ipbmap) bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth); bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart); bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size); + printk(KERN_DEBUG "dmMount : %d\n",bmp->db_agl2size); if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG || bmp->db_agl2size < 0) { err = -EINVAL; @@ -316,6 +317,7 @@ int dbSync(struct inode *ipbmap) dbmp_le->dn_agwidth = cpu_to_le32(bmp->db_agwidth); dbmp_le->dn_agstart = cpu_to_le32(bmp->db_agstart); dbmp_le->dn_agl2size = cpu_to_le32(bmp->db_agl2size); + printk(KERN_DEBUG "dbSync : %d\n",bmp->db_agl2size); for (i = 0; i < MAXAG; i++) dbmp_le->dn_agfree[i] = cpu_to_le64(bmp->db_agfree[i]); dbmp_le->dn_agsize = cpu_to_le64(bmp->db_agsize); @@ -3393,7 +3395,7 @@ int dbExtendFS(struct inode *ipbmap, s64 blkno, s64 nblocks) bmp->db_agl2size = l2agsize; bmp->db_agsize = 1 << l2agsize; - + printk(KERN_DEBUG "dbExtendFS : %d\n",bmp->db_agl2size); /* compute new number of AG */ agno = bmp->db_numag; bmp->db_numag = newsize >> l2agsize; -- 2.34.1
| ![\](/images/icornerr.gif) |