From: Ghanshyam Agrawal Date: Mon, 30 Sep 2024 08:12:18 +0000 (+0530) Subject: jfs: fix shift-out-of-bounds in dbSplit X-Git-Tag: v6.13-rc1~128^2~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d;p=thirdparty%2Fkernel%2Flinux.git jfs: fix shift-out-of-bounds in dbSplit When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself. Reported-by: syzbot+b5ca8a249162c4b9a7d0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ca8a249162c4b9a7d0 Signed-off-by: Ghanshyam Agrawal Signed-off-by: Dave Kleikamp --- diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 3ab410059dc20..39957361a7eed 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -1820,6 +1820,9 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results) return -EIO; dp = (struct dmap *) mp->data; + if (dp->tree.budmin < 0) + return -EIO; + /* try to allocate the blocks. */ rc = dbAllocDmapLev(bmp, dp, (int) nblocks, l2nb, results);