Messages in this thread Patch in this message | | | From | Manas Ghandat <> | Subject | [PATCH] jfs: fix array-index-out-of-bounds in dbFindLeaf | Date | Tue, 29 Aug 2023 22:22:44 +0530 |
| |
Currently while searching for dmtree_t for sufficient free blocks there is an array out of bounds while getting element in tp->dm_stree. Added the required bound check.
Ps: After I added the check I am getting the following log
[ 22.661748][ T4425] ERROR: (device loop0): dbAllocAny: unable to allocate blocks [ 22.661748][ T4425] [ 22.665536][ T4425] ERROR: (device loop0): remounting filesystem as read-only [ 22.667856][ T4425] jfs_mkdir: dtInsert returned -EIO [ 22.669750][ T4425] ERROR: (device loop0): txAbort:
I was wondering if these checks are significant of not?
Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com> Reported-by: syzbot+aea1ad91e854d0a83e04@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=aea1ad91e854d0a83e04 --- fs/jfs/jfs_dmap.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index a14a0f18a4c4..5af17b2287be 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2948,6 +2948,10 @@ static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx) /* sufficient free space found. move to the next * level (or quit if this is the last level). */ + + if (x + n > TREESIZE) + return -ENOSPC; + if (l2nb <= tp->dmt_stree[x + n]) break; } -- 2.37.2
| |