jfs: Fix array-index-out-of-bounds in diFree

Reported-by: syzbot+241c815bda521982cb49@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 2ec35889ad24ed03234798bc8fbce1164a0b4a92..1407feccbc2d05abec0b6be7ffaab32b5f44b7cd 100644 (file)
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -290,7 +290,7 @@ int diSync(struct inode *ipimap)
 int diRead(struct inode *ip)
 {
        struct jfs_sb_info *sbi = JFS_SBI(ip->i_sb);
-       int iagno, ino, extno, rc;
+       int iagno, ino, extno, rc, agno;
        struct inode *ipimap;
        struct dinode *dp;
        struct iag *iagp;
@@ -339,8 +339,11 @@ int diRead(struct inode *ip)
 
        /* get the ag for the iag */
        agstart = le64_to_cpu(iagp->agstart);
+       agno = BLKTOAG(agstart, JFS_SBI(ip->i_sb));
 
        release_metapage(mp);
+       if (agno >= MAXAG || agno < 0)
+               return -EIO;
 
        rel_inode = (ino & (INOSPERPAGE - 1));
        pageno = blkno >> sbi->l2nbperpage;