jfs: fix shift-out-of-bounds in dbSplit

When dmt_budmin is less than zero, it causes errors
in the later stages. Added a check to return an error beforehand
in dbAllocCtl itself.

Reported-by: syzbot+b5ca8a249162c4b9a7d0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b5ca8a249162c4b9a7d0
Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 3ab410059dc202a3e50bdbf505b690093ed18631..39957361a7eedfd4778fe99731f147ec3d2e21f2 100644 (file)
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1820,6 +1820,9 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results)
                        return -EIO;
                dp = (struct dmap *) mp->data;
 
+               if (dp->tree.budmin < 0)
+                       return -EIO;
+
                /* try to allocate the blocks.
                 */
                rc = dbAllocDmapLev(bmp, dp, (int) nblocks, l2nb, results);