Forwarded: Re: [syzbot] UBSAN: shift-out-of-bounds in dbAllocAG

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: Re: [syzbot] UBSAN: shift-out-of-bounds in dbAllocAG
Author: tristmd@xxxxxxxxx

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>From 68c84cc03503804c418f99cf442b48de6959405b Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 17 Apr 2026 16:15:15 +0000
Subject: [PATCH] jfs: add upper bound check for budmin in check_dmapctl()
check_dmapctl() validates that budmin >= BUDMIN but does not check
the upper bound. A corrupted filesystem image can set budmin to a
value larger than L2MAXL2SIZE, causing UBSAN shift-out-of-bounds
when the value is used as a shift count in dbAllocAG() and
dbFindCtl().
Add an upper bound check on budmin in check_dmapctl() to reject
values exceeding L2MAXL2SIZE.
Reported-by: syzbot+4b717071f1eecb2972df@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=4b717071f1eecb2972df
Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
---
 fs/jfs/jfs_dmap.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index a841cf2..eb7c3ba 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -190,9 +190,9 @@ static bool check_dmapctl(struct dmapctl *dcp)
 				nleafs);
 			return false;
 		}
-	} else if (unlikely(budmin < BUDMIN)) {
-		jfs_err("dmapctl: invalid budmin %d (min %d)",
-			budmin, BUDMIN);
+	} else if (unlikely(budmin < BUDMIN || budmin > L2MAXL2SIZE)) {
+		jfs_err("dmapctl: invalid budmin %d (valid range %d-%d)",
+			budmin, BUDMIN, L2MAXL2SIZE);
 		return false;
 	}
 
-- 
2.47.3