lkml.org 
[lkml]   [2022]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 260/475] jfs: fix divide error in dbNextAG
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    [ Upstream commit 2cc7cc01c15f57d056318c33705647f87dcd4aab ]

    Syzbot reported divide error in dbNextAG(). The problem was in missing
    validation check for malicious image.

    Syzbot crafted an image with bmp->db_numag equal to 0. There wasn't any
    validation checks, but dbNextAG() blindly use bmp->db_numag in divide
    expression

    Fix it by validating bmp->db_numag in dbMount() and return an error if
    image is malicious

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-and-tested-by: syzbot+46f5c25af73eb8330eb6@syzkaller.appspotmail.com
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/jfs/jfs_dmap.c | 7 +++++++
    1 file changed, 7 insertions(+)

    diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
    index 6fe82ce8663e..79f3440e204b 100644
    --- a/fs/jfs/jfs_dmap.c
    +++ b/fs/jfs/jfs_dmap.c
    @@ -148,6 +148,7 @@ static const s8 budtab[256] = {
    * 0 - success
    * -ENOMEM - insufficient memory
    * -EIO - i/o error
    + * -EINVAL - wrong bmap data
    */
    int dbMount(struct inode *ipbmap)
    {
    @@ -179,6 +180,12 @@ int dbMount(struct inode *ipbmap)
    bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree);
    bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage);
    bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
    + if (!bmp->db_numag) {
    + release_metapage(mp);
    + kfree(bmp);
    + return -EINVAL;
    + }
    +
    bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel);
    bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag);
    bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref);
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-04-14 17:07    [W:3.431 / U:0.832 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site