diff options
| author | Jeongjun Park <aha310510@gmail.com> | 2024-05-30 16:28:09 +0300 |
|---|---|---|
| committer | Dave Kleikamp <dave.kleikamp@oracle.com> | 2024-06-26 20:38:50 +0300 |
| commit | f73f969b2eb39ad8056f6c7f3a295fa2f85e313a (patch) | |
| tree | ccfb2dd0da0036ca1827747db37b026a357a4b0c /fs/jfs | |
| parent | ce6dede912f064a855acf6f04a04cbb2c25b8c8c (diff) | |
| download | linux-f73f969b2eb39ad8056f6c7f3a295fa2f85e313a.tar.xz | |
jfs: Fix array-index-out-of-bounds in diFree
Reported-by: syzbot+241c815bda521982cb49@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Diffstat (limited to 'fs/jfs')
| -rw-r--r-- | fs/jfs/jfs_imap.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c index 2ec35889ad24..1407feccbc2d 100644 --- a/fs/jfs/jfs_imap.c +++ b/fs/jfs/jfs_imap.c @@ -290,7 +290,7 @@ int diSync(struct inode *ipimap) int diRead(struct inode *ip) { struct jfs_sb_info *sbi = JFS_SBI(ip->i_sb); - int iagno, ino, extno, rc; + int iagno, ino, extno, rc, agno; struct inode *ipimap; struct dinode *dp; struct iag *iagp; @@ -339,8 +339,11 @@ int diRead(struct inode *ip) /* get the ag for the iag */ agstart = le64_to_cpu(iagp->agstart); + agno = BLKTOAG(agstart, JFS_SBI(ip->i_sb)); release_metapage(mp); + if (agno >= MAXAG || agno < 0) + return -EIO; rel_inode = (ino & (INOSPERPAGE - 1)); pageno = blkno >> sbi->l2nbperpage; |