Re: [PATCH] jfs: fix array-index-out-of-bounds

[Christophe JAILLET]

Le 22/09/2024 à 13:00, Ghanshyam Agrawal a écrit :
> In some cases, dn_numag may be greater than MAXAG which may
> result in an array-index-out-of-bounds in dbNextAG. Added
> a check to return an error code before we crash.
>
> Reported-by: syzbot+808f3f84407f08a93022@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=808f3f84407f08a93022
> Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@xxxxxxxxx>
> ---
>   fs/jfs/jfs_imap.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
> index 2ec35889ad24..5088da13e8f1 100644
> --- a/fs/jfs/jfs_imap.c
> +++ b/fs/jfs/jfs_imap.c
> @@ -1360,6 +1360,9 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
>   	if (agno < 0 || agno > dn_numag)
>   		return -EIO;
>   
> +	if (unlikely(dn_numag > MAXAG))

Hi,

looking at other places with checks with MAXAG, I wonder if it should be >=?

CJ

> +		return -EIO;
> +
>   	if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {
>   		/*
>   		 * There is an open file actively growing.  We want to