Re: [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in diNewExt

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: [jfs?] UBSAN: array-index-out-of-bounds in diNewExt
Author: eadavis@xxxxxx

please test array-index-out-of-bounds in diNewExt

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git bee0e7762ad2

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index a037ee59e398..b52f34e04f6a 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -1341,6 +1341,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
 	 */
 	if (dir) {
 		agno = dbNextAG(JFS_SBI(pip->i_sb)->ipbmap);
+		printk("agno/dbNextAG: %d, %s\n", agno, __func__);
 		AG_LOCK(imap, agno);
 		goto tryag;
 	}
@@ -1356,6 +1357,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
 
 	/* get the ag number of this iag */
 	agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
+	printk("agno/agstart: %d, %s\n", agno, __func__);
 	dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
 	if (agno < 0 || agno > dn_numag)
 		return -EIO;
@@ -1584,6 +1586,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
 	/*
 	 * try to allocate anywhere within the same AG as the parent inode.
 	 */
+	printk("agno: %d, agstart: %llu, %s\n", agno, JFS_IP(pip)->agstart, __func__);
 	rc = diAllocAG(imap, agno, dir, ip);
 
 	AG_UNLOCK(imap, agno);
@@ -1919,6 +1922,7 @@ static int diAllocExt(struct inomap * imap, int agno, struct inode *ip)
 		}
 		iagp = (struct iag *) mp->data;
 	}
+	printk("iagno: %d, %llu, %s\n", iagno, iagp->agstart, __func__);
 
 	/* using the free extent summary map, find a free extent.
 	 */
@@ -2179,6 +2183,9 @@ static int diNewExt(struct inomap * imap, struct iag * iagp, int extno)
 	/* get the ag and iag numbers for this iag.
 	 */
 	agno = BLKTOAG(le64_to_cpu(iagp->agstart), sbi);
+	if (agno > MAXAG || agno < 0)
+		return -EIO;
+
 	iagno = le32_to_cpu(iagp->iagnum);
 
 	/* check if this is the last free extent within the