[PATCH] jfs: Add check for array bounds in dtDelete

[Pedro Demarchi Gomes]

#syz test

---
 fs/jfs/jfs_dtree.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index ab11849cf9cc..b30f57304c09 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -2129,6 +2129,14 @@ int dtDelete(tid_t tid,
 					next_index = -1;
 				else {
 					stbl = DT_GETSTBL(np);
+					if (stbl[0] < 0 || stbl[0] >= DTPAGEMAXSLOT) {
+						jfs_err("JFS: Invalid stbl[0] = %d for inode %ld, block = %lld",
+							stbl[0], (long)ip->i_ino, (long long)le64_to_cpu(p->header.next));
+						DT_PUTPAGE(nmp);
+						DT_PUTPAGE(mp);
+						return -EIO;
+					}
+
 					ldtentry =
 					    (struct ldtentry *) & np->
 					    slot[stbl[0]];
-- 
2.39.5