jfs: fix out-of-bounds in dbNextAG() and diAlloc()

[ Upstream commit e63866a475562810500ea7f784099bfe341e761a ]

In dbNextAG() , there is no check for the case where bmp->db_numag is
greater or same than MAXAG due to a polluted image, which causes an
out-of-bounds. Therefore, a bounds check should be added in dbMount().

And in dbNextAG(), a check for the case where agpref is greater than
bmp->db_numag should be added, so an out-of-bounds exception should be
prevented.

Additionally, a check for the case where agno is greater or same than
MAXAG should be added in diAlloc() to prevent out-of-bounds.

Reported-by: Jeongjun Park <aha310510@gmail.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 9b6849b9bfdb9d5b44865aeedd9d3912a8cd4111..801996da08a45b2371893c38d5c1cc249a5a17e1 100644 (file)
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -187,7 +187,7 @@ int dbMount(struct inode *ipbmap)
        }
 
        bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
-       if (!bmp->db_numag) {
+       if (!bmp->db_numag || bmp->db_numag >= MAXAG) {
                err = -EINVAL;
                goto err_release_metapage;
        }
@@ -652,7 +652,7 @@ int dbNextAG(struct inode *ipbmap)
         * average free space.
         */
        for (i = 0 ; i < bmp->db_numag; i++, agpref++) {
-               if (agpref == bmp->db_numag)
+               if (agpref >= bmp->db_numag)
                        agpref = 0;
 
                if (atomic_read(&bmp->db_active[agpref]))

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 36ed75682064852d1de288926ad641e4d81c0057..da3a1c27d3498bee9591f1f043c5b2e5e95c2de1 100644 (file)
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -1362,7 +1362,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
        /* get the ag number of this iag */
        agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
        dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
-       if (agno < 0 || agno > dn_numag)
+       if (agno < 0 || agno > dn_numag || agno >= MAXAG)
                return -EIO;
 
        if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {