From nobody Mon Sep 16 19:16:26 2024 Received: from out162-62-57-252.mail.qq.com (out162-62-57-252.mail.qq.com [162.62.57.252]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E31721CAA4 for ; Fri, 26 Jul 2024 14:35:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.252 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1722004543; cv=none; b=l7wEqutlcHhYMTAU7fADbDNgCmQD1mZyVbfau59QCxcjw8fb82FK4Gx/8yMgoiv5rfQtHrTCE3YAGAPwab3IXxG3xtI3gx9Hm6EEpNItKWO0+6dlpdsPodG3w5nBjXDZ9H5Y5CU9SjjmRKWet/j2ZsDi0QkyL2PV5JAqbVNLjjU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1722004543; c=relaxed/simple; bh=xBCgu9FNQnnP2P5osUR1+wUHCUDQz/+XEE4Is7LlvUw=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=Mf6iTr9cnB97ytyDLkXecrnlFV8Qejfl/QgW6a/ykGG0K48WOtFUS/vZ571SergJKmpyQE3AAtgFSaArmid1lubQNz0xuU/78CkyYPHQScFgL+dOrvDYzMBYgahvOg8tECkfybhz/HTiCAHdSUMEMMjgNCoqhYyBUWpaQYxWw5E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=pjDnxFmh; arc=none smtp.client-ip=162.62.57.252 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="pjDnxFmh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1722004530; bh=RYy2lkXdrqvvRQ6HUau4IEEmxjZjv7SYZfEboVOissk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=pjDnxFmh3a5cIwz31gFXAofenzQWfUWqEGzJzDuesnH9nNTNfc18QlivJUbuNZNPs 2scPo1LUQPW8YQ8eemSX+WirF7L6Bjq+BV/fzzNiT6g4gy3bvtjxUOoi73XuLgzvOX oxaO3Sbh7x18txiC4JHs19pw1POwyz0xEYgJi9bc= Received: from pek-lxu-l1.wrs.com ([111.198.228.103]) by newxmesmtplogicsvrszb9-0.qq.com (NewEsmtp) with SMTP id 59215058; Fri, 26 Jul 2024 22:22:18 +0800 X-QQ-mid: xmsmtpt1722003738terxm588f Message-ID: X-QQ-XMAILINFO: NvKyM24IHTKSSrukGyLZFBr6AF0D5OZmp3rvMMXqB0ntwiSTCqE/LPUMPeQxGO 8kSCg5zMjGQDAHC/y0XqQAb+HLFxf6C+kXDz+8rShCQEQYZJ01MszrWZrYWwjtFs8rV1W5yeD3zV lUJUCeALR60JuVawf5Sh10wjc/HJceUiF0VMcwGMHBt91fzrDLKacDAlhSVuwlPAvjVoaZMJ7tjJ KGv5SctVuAT483fIiSLRF45/7SLHhfkmBZD3zgFAogSsvsU41u5cqK2rYTVqWXXU9NueELhRSQH/ JJESbHEdJjmsMEY8DQHjaaSdfU4Vep/L12uc1k8zYyR5uo29rlpKsl6Y08NsMEl8Q04D6sBhxpFs cWN7WV+uRp4+DIb46gJm5GJWFhaV0EAdUI2o0QurLalh0G42iZBKvYOINBgqKIrbRUuGXrcJGQ+Z 2XUhCeJf3JkEh0r6AA8aAfPE61cruSKlcO3G/5oWixsZtLgL2CzBGpmnL8D+0Wg3Utlk5dVFH8RQ Wx1Ka9R0mn48yDEH6n7TFPEwGRyTe1vm2eHzg6+kE5wsDLKivhgu6nPHwVFQrzy7pHIChY6LPwEN c7usomrPGQ71OPhuqpAHOmc7JdyBc+MiFJIhqCYJfI8GoDpyWDT5tZ3RPchofrd0MGhE0kl0T7um nT09DdU9/zGAPMgocpm0qnT9YDiq+3E8DJ6+aDKeHhoP2VYQc3gO6DSxu/UDer+kcrPoyi/sOdbt e+zirI+Xc+Z2R9x0+5AD0uoaDOW8xMgHJnRel1/Qcbkg7E+p74deLlHtw9OAvDF0xJN2OYM+/FKQ j4zq9XQagQorS5J7tcvxTmn6Z53MoMXDO+tABQS9kJvupltz/E3b6hWDk5q8iLmTjXaUYqRSKmUh uckJRN1kgaDE/Is7dmm3XnM5f3JVFGjuliuXq4HdOndqHSfrDWKFr24k/GaXGc2w== X-QQ-XMRINFO: OWPUhxQsoeAVDbp3OJHYyFg= From: Edward Adam Davis To: syzbot+dca05492eff41f604890@syzkaller.appspotmail.com Cc: jfs-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org, shaggy@kernel.org, syzkaller-bugs@googlegroups.com Subject: [PATCH] jfs: check if dmt_leafidx is less than zero Date: Fri, 26 Jul 2024 22:22:19 +0800 X-OQ-MSGID: <20240726142218.2293706-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <00000000000064c7a0061e2004d6@google.com> References: <00000000000064c7a0061e2004d6@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" syzbot report a out of bounds in dbSplit, it because dmt_leafidx less than 0, add a checking for dmt_leafidx in dbAllocDmapLev. Reported-by: syzbot+dca05492eff41f604890@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3Ddca05492eff41f604890 Signed-off-by: Edward Adam Davis --- fs/jfs/jfs_dmap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index cb3cda1390ad..c5b8883599e3 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1956,6 +1956,7 @@ dbAllocDmapLev(struct bmap * bmp, { s64 blkno; int leafidx, rc; + dmtree_t *tp =3D (dmtree_t *) &dp->tree; =20 /* can't be more than a dmaps worth of blocks */ assert(l2nb <=3D L2BPERDMAP); @@ -1964,10 +1965,10 @@ dbAllocDmapLev(struct bmap * bmp, * free space. if sufficient free space is found, dbFindLeaf() * returns the index of the leaf at which free space was found. */ - if (dbFindLeaf((dmtree_t *) &dp->tree, l2nb, &leafidx, false)) + if (dbFindLeaf(tp, l2nb, &leafidx, false)) return -ENOSPC; =20 - if (leafidx < 0) + if (leafidx < 0 || le32_to_cpu(tp->dmt_leafidx) < 0) return -EIO; =20 /* determine the block number within the file system corresponding --=20 2.43.0