All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Hoi Pok Wu <wuhoipok@gmail.com>,
	Dave Kleikamp <dave.kleikamp@oracle.com>,
	Sasha Levin <sashal@kernel.org>,
	shaggy@kernel.org, mudongliangabcd@gmail.com, r33s3n6@gmail.com,
	paskripkin@gmail.com, jfs-discussion@lists.sourceforge.net
Subject: [PATCH AUTOSEL 6.1 04/22] fs: jfs: fix shift-out-of-bounds in dbDiscardAG
Date: Sat, 17 Dec 2022 10:27:05 -0500	[thread overview]
Message-ID: <20221217152727.98061-4-sashal@kernel.org> (raw)
In-Reply-To: <20221217152727.98061-1-sashal@kernel.org>

From: Hoi Pok Wu <wuhoipok@gmail.com>

[ Upstream commit 25e70c6162f207828dd405b432d8f2a98dbf7082 ]

This should be applied to most URSAN bugs found recently by syzbot,
by guarding the dbMount. As syzbot feeding rubbish into the bmap
descriptor.

Signed-off-by: Hoi Pok Wu <wuhoipok@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_dmap.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index e1cbfbb60303..765838578a72 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -198,6 +198,11 @@ int dbMount(struct inode *ipbmap)
 		goto err_release_metapage;
 	}
 
+	if (((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) {
+		err = -EINVAL;
+		goto err_release_metapage;
+	}
+
 	for (i = 0; i < MAXAG; i++)
 		bmp->db_agfree[i] = le64_to_cpu(dbmp_le->dn_agfree[i]);
 	bmp->db_agsize = le64_to_cpu(dbmp_le->dn_agsize);
-- 
2.35.1


  parent reply	other threads:[~2022-12-17 15:28 UTC|newest]

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-12-17 15:27 [PATCH AUTOSEL 6.1 01/22] fs: jfs: fix shift-out-of-bounds in dbAllocAG Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 02/22] udf: Avoid double brelse() in udf_rename() Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 03/22] jfs: Fix fortify moan in symlink Sasha Levin
2022-12-17 15:27 ` Sasha Levin [this message]
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 05/22] ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 06/22] ACPI: EC: Add quirk for the HP Pavilion Gaming 15-cx0041ur Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 07/22] ACPICA: Fix error code path in acpi_ds_call_control_method() Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 08/22] thermal/core: Ensure that thermal device is registered in thermal_zone_get_temp Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 09/22] ACPI: video: Change GIGABYTE GB-BXBT-2807 quirk to force_none Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 10/22] ACPI: video: Change Sony Vaio VPCEH3U1E quirk to force_native Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 11/22] ACPI: video: Add force_vendor quirk for Sony Vaio PCG-FRV35 Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 12/22] ACPI: video: Add force_native quirk for Sony Vaio VPCY11S1E Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 13/22] proc/vmcore: fix potential memory leak in vmcore_init() Sasha Levin
2022-12-17 15:27   ` Sasha Levin
2022-12-18  0:32   ` Andrew Morton
2022-12-18  0:32     ` Andrew Morton
2022-12-18 11:28     ` Sasha Levin
2022-12-18 11:28       ` Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 14/22] nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() Sasha Levin
2022-12-17 15:27   ` Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 15/22] nilfs2: fix shift-out-of-bounds due to too large exponent of block size Sasha Levin
2022-12-17 15:27   ` Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 16/22] ACPI / PCI: fix LPIC IRQ model default PCI IRQ polarity Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 17/22] acct: fix potential integer overflow in encode_comp_t() Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 18/22] x86/apic: Handle no CONFIG_X86_X2APIC on systems with x2APIC enabled by BIOS Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 19/22] ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Tab 3 Pro (YT3-X90F) Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 20/22] btrfs: do not panic if we can't allocate a prealloc extent state Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 21/22] ACPI: x86: Add skip i2c clients quirk for Medion Lifetab S10346 Sasha Levin
2022-12-17 15:27 ` [PATCH AUTOSEL 6.1 22/22] hfs: fix OOB Read in __hfs_brec_find Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221217152727.98061-4-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=dave.kleikamp@oracle.com \
    --cc=jfs-discussion@lists.sourceforge.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mudongliangabcd@gmail.com \
    --cc=paskripkin@gmail.com \
    --cc=r33s3n6@gmail.com \
    --cc=shaggy@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=wuhoipok@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.