Messages in this thread | | | Date | Wed, 1 Nov 2023 12:12:06 +0530 | Subject | Re: [PATCH] jfs: fix shift-out-of-bounds in dbJoin | From | Manas Ghandat <> |
| |
Hi, can you please review this patch
On 16/10/23 20:30, Manas Ghandat wrote: > Just a friendly ping :) > > On 11/10/23 20:09, Manas Ghandat wrote: >> Currently while joining the leaf in a buddy system there is shift out >> of bound error in calculation of BUDSIZE. Added the required check >> to the BUDSIZE and fixed the documentation as well. >> >> Reported-by: syzbot+411debe54d318eaed386@syzkaller.appspotmail.com >> Closes: https://syzkaller.appspot.com/bug?extid=411debe54d318eaed386 >> Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com> >> --- >> fs/jfs/jfs_dmap.c | 8 +++++++- >> 1 file changed, 7 insertions(+), 1 deletion(-) >> >> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c >> index 6b838d3ae7c2..baa97bda1c7a 100644 >> --- a/fs/jfs/jfs_dmap.c >> +++ b/fs/jfs/jfs_dmap.c >> @@ -2730,7 +2730,9 @@ static int dbBackSplit(dmtree_t * tp, int leafno) >> * leafno - the number of the leaf to be updated. >> * newval - the new value for the leaf. >> * >> - * RETURN VALUES: none >> + * RETURN VALUES: >> + * 0 - success >> + * -EIO - i/o error >> */ >> static int dbJoin(dmtree_t * tp, int leafno, int newval) >> { >> @@ -2757,6 +2759,10 @@ static int dbJoin(dmtree_t * tp, int leafno, >> int newval) >> * get the buddy size (number of words covered) of >> * the new value. >> */ >> + >> + if ((newval - tp->dmt_budmin) > BUDMIN) >> + return -EIO; >> + >> budsz = BUDSIZE(newval, tp->dmt_budmin); >> /* try to join.
| |