jfs: define xtree root and page independently

commit a779ed754e52d582b8c0e17959df063108bd0656 upstream.

In order to make array bounds checking sane, provide a separate
definition of the in-inode xtree root and the external xtree page.

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Tested-by: Manas Ghandat <ghandatmanas@gmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=ccb458b6679845ee0bae
Reported-by: syzbot+ccb458b6679845ee0bae@syzkaller.appspotmail.com
Signed-off-by: Aditya Dutt <duttaditya18@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/jfs/jfs_dinode.h b/fs/jfs/jfs_dinode.h
index 6b231d0d0071ba6a06a66192882c99b4014f55a7..603aae17a69343fcd766d12dbf2231c4fe7cd173 100644 (file)
--- a/fs/jfs/jfs_dinode.h
+++ b/fs/jfs/jfs_dinode.h
@@ -96,7 +96,7 @@ struct dinode {
 #define di_gengen      u._file._u1._imap._gengen
 
                        union {
-                               xtpage_t _xtroot;
+                               xtroot_t _xtroot;
                                struct {
                                        u8 unused[16];  /* 16: */
                                        dxd_t _dxd;     /* 16: */

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 155f66812934a8b1e940d5adc526c00b88d52c2a..9adb29e7862cfc4c2b027ba6f226f808588c60f2 100644 (file)
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -673,7 +673,7 @@ int diWrite(tid_t tid, struct inode *ip)
                 * This is the special xtree inside the directory for storing
                 * the directory table
                 */
-               xtpage_t *p, *xp;
+               xtroot_t *p, *xp;
                xad_t *xad;
 
                jfs_ip->xtlid = 0;
@@ -687,7 +687,7 @@ int diWrite(tid_t tid, struct inode *ip)
                 * copy xtree root from inode to dinode:
                 */
                p = &jfs_ip->i_xtroot;
-               xp = (xtpage_t *) &dp->di_dirtable;
+               xp = (xtroot_t *) &dp->di_dirtable;
                lv = ilinelock->lv;
                for (n = 0; n < ilinelock->index; n++, lv++) {
                        memcpy(&xp->xad[lv->offset], &p->xad[lv->offset],
@@ -716,7 +716,7 @@ int diWrite(tid_t tid, struct inode *ip)
         *      regular file: 16 byte (XAD slot) granularity
         */
        if (type & tlckXTREE) {
-               xtpage_t *p, *xp;
+               xtroot_t *p, *xp;
                xad_t *xad;
 
                /*

diff --git a/fs/jfs/jfs_incore.h b/fs/jfs/jfs_incore.h
index 721def69e732e444c18bdde9ae271da98260ca02..dd4264aa9beddecd58e17cd44a730d30acba4176 100644 (file)
--- a/fs/jfs/jfs_incore.h
+++ b/fs/jfs/jfs_incore.h
@@ -66,7 +66,7 @@ struct jfs_inode_info {
        lid_t   xtlid;          /* lid of xtree lock on directory */
        union {
                struct {
-                       xtpage_t _xtroot;       /* 288: xtree root */
+                       xtroot_t _xtroot;       /* 288: xtree root */
                        struct inomap *_imap;   /* 4: inode map header  */
                } file;
                struct {

diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index 6c8680d3907afdba689456fe84132058f16c20bc..3a547e0b934f24c2a3f1ad464a3aa974d6cd5c6a 100644 (file)
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -783,7 +783,7 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
                        if (mp->xflag & COMMIT_PAGE)
                                p = (xtpage_t *) mp->data;
                        else
-                               p = &jfs_ip->i_xtroot;
+                               p = (xtpage_t *) &jfs_ip->i_xtroot;
                        xtlck->lwm.offset =
                            le16_to_cpu(p->header.nextindex);
                }
@@ -1710,7 +1710,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
 
        if (tlck->type & tlckBTROOT) {
                lrd->log.redopage.type |= cpu_to_le16(LOG_BTROOT);
-               p = &JFS_IP(ip)->i_xtroot;
+               p = (xtpage_t *) &JFS_IP(ip)->i_xtroot;
                if (S_ISDIR(ip->i_mode))
                        lrd->log.redopage.type |=
                            cpu_to_le16(LOG_DIR_XTREE);

diff --git a/fs/jfs/jfs_xtree.c b/fs/jfs/jfs_xtree.c
index 3148e9b35f3bcbe71ca070ded6f25bd97197ffd3..34db519933b4d9fd24ae5440f64516234aa94d33 100644 (file)
--- a/fs/jfs/jfs_xtree.c
+++ b/fs/jfs/jfs_xtree.c
@@ -1224,7 +1224,7 @@ xtSplitRoot(tid_t tid,
        struct xtlock *xtlck;
        int rc;
 
-       sp = &JFS_IP(ip)->i_xtroot;
+       sp = (xtpage_t *) &JFS_IP(ip)->i_xtroot;
 
        INCREMENT(xtStat.split);
 
@@ -3059,7 +3059,7 @@ static int xtRelink(tid_t tid, struct inode *ip, xtpage_t * p)
  */
 void xtInitRoot(tid_t tid, struct inode *ip)
 {
-       xtpage_t *p;
+       xtroot_t *p;
 
        /*
         * acquire a transaction lock on the root

diff --git a/fs/jfs/jfs_xtree.h b/fs/jfs/jfs_xtree.h
index 5f51be8596b34c1c34b791c5c29dc54956ebe4c9..dc9b5f8d6385994057000efdf00bd694d6f32154 100644 (file)
--- a/fs/jfs/jfs_xtree.h
+++ b/fs/jfs/jfs_xtree.h
@@ -65,24 +65,33 @@ struct xadlist {
 #define XTPAGEMAXSLOT  256
 #define XTENTRYSTART   2
 
-/*
- *     xtree page:
- */
-typedef union {
-       struct xtheader {
-               __le64 next;    /* 8: */
-               __le64 prev;    /* 8: */
+struct xtheader {
+       __le64 next;    /* 8: */
+       __le64 prev;    /* 8: */
 
-               u8 flag;        /* 1: */
-               u8 rsrvd1;      /* 1: */
-               __le16 nextindex;       /* 2: next index = number of entries */
-               __le16 maxentry;        /* 2: max number of entries */
-               __le16 rsrvd2;  /* 2: */
+       u8 flag;        /* 1: */
+       u8 rsrvd1;      /* 1: */
+       __le16 nextindex;       /* 2: next index = number of entries */
+       __le16 maxentry;        /* 2: max number of entries */
+       __le16 rsrvd2;  /* 2: */
 
-               pxd_t self;     /* 8: self */
-       } header;               /* (32) */
+       pxd_t self;     /* 8: self */
+};
 
+/*
+ *     xtree root (in inode):
+ */
+typedef union {
+       struct xtheader header;
        xad_t xad[XTROOTMAXSLOT];       /* 16 * maxentry: xad array */
+} xtroot_t;
+
+/*
+ *     xtree page:
+ */
+typedef union {
+       struct xtheader header;
+       xad_t xad[XTPAGEMAXSLOT];       /* 16 * maxentry: xad array */
 } xtpage_t;
 
 /*