Similar to the issue fixed in commit 49f9637aafa6 ("jfs: fix
array-index-out-of-bounds in diNewExt"), the diExtendFS() function
also lacks validation for the AG (allocation group) number.
In diExtendFS(), the variable 'n' is computed from iagp->agstart
which is read from disk. If agstart contains a malicious or corrupted
value, 'n' may exceed the bounds of the im_agctl[] array (size MAXAG),
leading to an out-of-bounds access.
Add a boundary check for 'n' after computation to ensure it falls
within the valid range [0, MAXAG). If the check fails, release the
metapage and return -EIO.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
---
fs/jfs/jfs_imap.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index ecb8e05b8b84..24b414bffd29 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -2900,6 +2900,11 @@ int diExtendFS(struct inode *ipimap, struct inode *ipbmap)
agstart = le64_to_cpu(iagp->agstart);
n = agstart >> mp->db_agl2size;
+ if (n < 0 || n >= MAXAG) {
+ release_metapage(bp);
+ jfs_error(ipimap->i_sb, "invalid AG number\n");
+ return -EIO;
+ }
iagp->agstart = cpu_to_le64((s64)n << mp->db_agl2size);
/* compute backed inodes */
--
2.34.1