Messages in this thread Patch in this message | | | From | Hoi Pok Wu <> | Subject | [PATCH] fs: jfs: fix shift-out-of-bounds in dbDiscardAG | Date | Wed, 19 Oct 2022 17:38:25 +0800 |
| |
Bug reported by syzbot, UBSAN: array-index-out-of-bounds in dbDiscardAG. Fixed by simply rearranging agno_end smaller than MAXAG. However, I wonder if it is a better idea to return -EINVAL, rejecting user input. Thank you.
Reported-by: syzbot+f0e0fcf3cd1047ae60ad@syzkaller.appspotmail.com Signed-off-by: Hoi Pok Wu <wuhoipok@gmail.com> --- fs/jfs/jfs_discard.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/fs/jfs/jfs_discard.c b/fs/jfs/jfs_discard.c index 575cb2ba74fc..3101eaf3098a 100644 --- a/fs/jfs/jfs_discard.c +++ b/fs/jfs/jfs_discard.c @@ -96,6 +96,10 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range) */ agno = BLKTOAG(start, JFS_SBI(ip->i_sb)); agno_end = BLKTOAG(end, JFS_SBI(ip->i_sb)); + + if (agno_end >= MAXAG) + agno_end = MAXAG - 1; + while (agno <= agno_end) { trimmed += dbDiscardAG(ip, agno, minlen); agno++; -- 2.38.0
| |