jfs: Regular file corruption check

[ Upstream commit 2d04df8116426b6c7b9f8b9b371250f666a2a2fb ]

The reproducer builds a corrupted file on disk with a negative i_size value.
Add a check when opening this file to avoid subsequent operation failures.

Reported-by: syzbot+630f6d40b3ccabc8e96e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=630f6d40b3ccabc8e96e
Tested-by: syzbot+630f6d40b3ccabc8e96e@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/jfs/file.c b/fs/jfs/file.c
index 01b6912e60f80891f148a0c2679f5a35e6d74586..742cadd1f37e84f71e6224fdbec01313d00a3cb8 100644 (file)
--- a/fs/jfs/file.c
+++ b/fs/jfs/file.c
@@ -44,6 +44,9 @@ static int jfs_open(struct inode *inode, struct file *file)
 {
        int rc;
 
+       if (S_ISREG(inode->i_mode) && inode->i_size < 0)
+               return -EIO;
+
        if ((rc = dquot_file_open(inode, file)))
                return rc;