hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

jfs: fix shift-out-of-bounds in dbJoin 

[ Upstream commit cca974daeb ]

Currently while joining the leaf in a buddy system there is shift out
of bound error in calculation of BUDSIZE. Added the required check
to the BUDSIZE and fixed the documentation as well.

Reported-by: syzbot+411debe54d318eaed386@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=411debe54d318eaed386
Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Manas Ghandat 2023-10-11 20:09:37 +05:30 committed by Greg Kroah-Hartman
parent 3999d26986
commit 0b24b79410
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fs/jfs/jfs_dmap.c
View File

@ -2763,7 +2763,9 @@ static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl)
* leafno - the number of the leaf to be updated.
* newval - the new value for the leaf.
*
* RETURN VALUES: none
* RETURN VALUES:
* 0 - success
* -EIO - i/o error
*/
static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl)
{
@ -2790,6 +2792,10 @@ static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl)
* get the buddy size (number of words covered) of
* the new value.
*/
if ((newval - tp->dmt_budmin) > BUDMIN)
return -EIO;
budsz = BUDSIZE(newval, tp->dmt_budmin);
/* try to join.