summaryrefslogtreecommitdiff
path: root/fs/jfs
diff options
context:
space:
mode:
authorLiu Shixin via Jfs-discussion <jfs-discussion@lists.sourceforge.net>2022-11-03 11:01:59 +0800
committerDave Kleikamp <dave.kleikamp@oracle.com>2023-01-03 10:43:37 -0600
commitfad376fce0af58deebc5075b8539dc05bf639af3 (patch)
treeba76dc74298fa11094b794c8d637b0e7500c063a /fs/jfs
parent69b41ac87e4a664de78a395ff97166f0b2943210 (diff)
fs/jfs: fix shift exponent db_agl2size negative
As a shift exponent, db_agl2size can not be less than 0. Add the missing check to fix the shift-out-of-bounds bug reported by syzkaller: UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:2227:15 shift exponent -744642816 is negative Reported-by: syzbot+0be96567042453c0c820@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Liu Shixin <liushixin2@huawei.com> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Diffstat (limited to 'fs/jfs')
-rw-r--r--fs/jfs/jfs_dmap.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 765838578a72..a3eb1e826947 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -193,7 +193,8 @@ int dbMount(struct inode *ipbmap)
bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth);
bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart);
bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size);
- if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG) {
+ if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG ||
+ bmp->db_agl2size < 0) {
err = -EINVAL;
goto err_release_metapage;
}