mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

jfs: fix shift-out-of-bounds in dbJoin 

Currently while joining the leaf in a buddy system there is shift out
of bound error in calculation of BUDSIZE. Added the required check
to the BUDSIZE and fixed the documentation as well.

Reported-by: syzbot+411debe54d318eaed386@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=411debe54d318eaed386
Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
This commit is contained in:
Manas Ghandat 2023-10-11 20:09:37 +05:30 committed by Dave Kleikamp
parent e0e1958f4c
commit cca974daeb
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fs/jfs/jfs_dmap.c
View File

@ -2763,7 +2763,9 @@ static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl)
* leafno - the number of the leaf to be updated.
* newval - the new value for the leaf.
*
* RETURN VALUES: none
* RETURN VALUES:
* 0 - success
* -EIO - i/o error
*/
static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl)
{
@ -2790,6 +2792,10 @@ static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl)
* get the buddy size (number of words covered) of
* the new value.
*/
if ((newval - tp->dmt_budmin) > BUDMIN)
return -EIO;
budsz = BUDSIZE(newval, tp->dmt_budmin);
/* try to join.