[PATCH] jfs: return -ENOSPC instead of BUG() on corrupted dmap tree in dbFindLeaf

[Nguyen Ngoc Thang]

dbFindLeaf() trusts the on-disk dmtree summary values: the root level
says free space exists, then it searches each level's 4 children for
one that actually provides it. A corrupted (e.g. crafted/fuzzed) JFS
image can have a parent claim space that none of its children provide,
which is neither validated on mount nor recoverable here -- it used to
hit assert(n < 4), i.e. BUG(), crashing the kernel. Treat it the same
way as the two existing sanity checks in this function and return
-ENOSPC instead.

Reported-by: syzbot+dcea2548c903300a400e@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=dcea2548c903300a400e
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@xxxxxxxxx>
---
 fs/jfs/jfs_dmap.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index a841cf21da7d..079765450bb2 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -3065,9 +3065,12 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
 		}
 
 		/* better have found something since the higher
-		 * levels of the tree said it was here.
+		 * levels of the tree said it was here. A corrupted tree
+		 * can claim free space at a level that no child actually
+		 * provides.
 		 */
-		assert(n < 4);
+		if (n == 4)
+			return -ENOSPC;
 	}
 	if (le32_to_cpu(tp->dmt_leafidx) >= max_idx)
 		return -ENOSPC;
-- 
2.43.0