In dbNextAG() , there is no check for the case where bmp->db_numag is 
greater or same than MAXAG due to a polluted image, which causes an 
out-of-bounds. Therefore, a bounds check should be added in dbMount().

And in dbNextAG(), a check for the case where agpref is greater than 
bmp->db_numag should be added, so an out-of-bounds exception should be 
prevented.

Additionally, a check for the case where agno is greater or same than 
MAXAG should be added in diAlloc() to prevent out-of-bounds.

Reported-by: Jeongjun Park <aha310510@gmail.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
---
 fs/jfs/jfs_dmap.c | 4 ++--
 fs/jfs/jfs_imap.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 5713994328cb..0625d1c0d064 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -187,7 +187,7 @@ int dbMount(struct inode *ipbmap)
 	}
 
 	bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
-	if (!bmp->db_numag) {
+	if (!bmp->db_numag || bmp->db_numag >= MAXAG) {
 		err = -EINVAL;
 		goto err_release_metapage;
 	}
@@ -652,7 +652,7 @@ int dbNextAG(struct inode *ipbmap)
 	 * average free space.
 	 */
 	for (i = 0 ; i < bmp->db_numag; i++, agpref++) {
-		if (agpref == bmp->db_numag)
+		if (agpref >= bmp->db_numag)
 			agpref = 0;
 
 		if (atomic_read(&bmp->db_active[agpref]))
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 1407feccbc2d..a360b24ed320 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -1360,7 +1360,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
 	/* get the ag number of this iag */
 	agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
 	dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
-	if (agno < 0 || agno > dn_numag)
+	if (agno < 0 || agno > dn_numag || agno >= MAXAG)
 		return -EIO;
 
 	if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
--

On 8/18/24 11:05PM, Jeongjun Park wrote:
> In dbNextAG() , there is no check for the case where bmp->db_numag is
> greater or same than MAXAG due to a polluted image, which causes an
> out-of-bounds. Therefore, a bounds check should be added in dbMount().
> 
> And in dbNextAG(), a check for the case where agpref is greater than
> bmp->db_numag should be added, so an out-of-bounds exception should be
> prevented.
> 
> Additionally, a check for the case where agno is greater or same than
> MAXAG should be added in diAlloc() to prevent out-of-bounds.

Looks good. Applied.

Shaggy

> 
> Reported-by: Jeongjun Park <aha310510@gmail.com>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Jeongjun Park <aha310510@gmail.com>
> ---
>   fs/jfs/jfs_dmap.c | 4 ++--
>   fs/jfs/jfs_imap.c | 2 +-
>   2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index 5713994328cb..0625d1c0d064 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -187,7 +187,7 @@ int dbMount(struct inode *ipbmap)
>   	}
>   
>   	bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
> -	if (!bmp->db_numag) {
> +	if (!bmp->db_numag || bmp->db_numag >= MAXAG) {
>   		err = -EINVAL;
>   		goto err_release_metapage;
>   	}
> @@ -652,7 +652,7 @@ int dbNextAG(struct inode *ipbmap)
>   	 * average free space.
>   	 */
>   	for (i = 0 ; i < bmp->db_numag; i++, agpref++) {
> -		if (agpref == bmp->db_numag)
> +		if (agpref >= bmp->db_numag)
>   			agpref = 0;
>   
>   		if (atomic_read(&bmp->db_active[agpref]))
> diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
> index 1407feccbc2d..a360b24ed320 100644
> --- a/fs/jfs/jfs_imap.c
> +++ b/fs/jfs/jfs_imap.c
> @@ -1360,7 +1360,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
>   	/* get the ag number of this iag */
>   	agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
>   	dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
> -	if (agno < 0 || agno > dn_numag)
> +	if (agno < 0 || agno > dn_numag || agno >= MAXAG)
>   		return -EIO;
>   
>   	if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
> --