Messages in this thread Patch in this message | | | From | Manas Ghandat <> | Subject | [PATCH] jfs : fs array-index-out-of-bounds in txCommit | Date | Tue, 19 Sep 2023 21:25:42 +0530 |
| |
Currently there is no check for out of bound access for xad in the struct xtpage_t. Added the required check at various places for the same
Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com> Reported-by: syzbot+0558d19c373e44da3c18@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0558d19c373e44da3c18 Fixes: df0cc57e057f --- fs/jfs/jfs_txnmgr.c | 4 ++++ fs/jfs/jfs_xtree.c | 6 ++++++ 2 files changed, 10 insertions(+)
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c index ce4b4760fcb1..6c6640942bed 100644 --- a/fs/jfs/jfs_txnmgr.c +++ b/fs/jfs/jfs_txnmgr.c @@ -1722,6 +1722,10 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd, jfs_err("xtLog: lwm > next"); goto out; } + if (lwm >= XTROOTMAXSLOT) { + jfs_err("xtLog: lwm out of range"); + goto out; + } tlck->flag |= tlckUPDATEMAP; xadlock->flag = mlckALLOCXADLIST; xadlock->count = next - lwm; diff --git a/fs/jfs/jfs_xtree.c b/fs/jfs/jfs_xtree.c index 2d304cee884c..57569c52663e 100644 --- a/fs/jfs/jfs_xtree.c +++ b/fs/jfs/jfs_xtree.c @@ -357,6 +357,9 @@ static int xtSearch(struct inode *ip, s64 xoff, s64 *nextp, for (base = XTENTRYSTART; lim; lim >>= 1) { index = base + (lim >> 1); + if (index >= XTROOTMAXSLOT) + goto out; + XT_CMP(cmp, xoff, &p->xad[index], t64); if (cmp == 0) { /* @@ -618,6 +621,9 @@ int xtInsert(tid_t tid, /* transaction id */ memmove(&p->xad[index + 1], &p->xad[index], (nextindex - index) * sizeof(xad_t)); + if (index >= XTROOTMAXSLOT) + goto out; + /* insert the new entry: mark the entry NEW */ xad = &p->xad[index]; XT_PUTENTRY(xad, xflag, xoff, xlen, xaddr); -- 2.37.2
| |