linux/fs/jfs
Arnaud Lecomte 49ea46d902 jfs: upper bound check of tree index in dbAllocAG
[ Upstream commit c214006856 ]

When computing the tree index in dbAllocAG, we never check if we are
out of bounds realative to the size of the stree.
This could happen in a scenario where the filesystem metadata are
corrupted.

Reported-by: syzbot+cffd18309153948f3c3e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cffd18309153948f3c3e
Tested-by: syzbot+cffd18309153948f3c3e@syzkaller.appspotmail.com
Signed-off-by: Arnaud Lecomte <contact@arnaud-lcm.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-08-28 16:26:00 +02:00
..
acl.c vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
file.c jfs: Regular file corruption check 2025-08-28 16:26:00 +02:00
inode.c jfs: truncate good inode pages when hard link is 0 2025-08-28 16:25:59 +02:00
ioctl.c block: add a bdev_discard_granularity helper 2022-04-17 19:49:59 -06:00
jfs_acl.h vfs: add rcu argument to ->get_acl() callback 2021-08-18 22:08:24 +02:00
jfs_btree.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_debug.c proc: convert everything to "struct proc_ops" 2020-02-04 03:05:26 +00:00
jfs_debug.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_dinode.h jfs: define xtree root and page independently 2025-05-02 07:47:08 +02:00
jfs_discard.c jfs: Fix uaf in dbFreeBits 2024-10-17 15:21:44 +02:00
jfs_discard.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_dmap.c jfs: upper bound check of tree index in dbAllocAG 2025-08-28 16:26:00 +02:00
jfs_dmap.h jfs: Fix array index bounds check in dbAdjTree 2020-11-13 16:03:07 -06:00
jfs_dtree.c jfs: add index corruption check to DT_GETPAGE() 2025-04-10 14:33:43 +02:00
jfs_dtree.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_extent.c jfs: validate max amount of blocks before allocation. 2023-09-13 09:42:49 +02:00
jfs_extent.h jfs: delete duplicated words + other fixes 2020-11-13 13:36:00 -06:00
jfs_filsys.h jfs: jfs_dmap: Validate db_l2nbperpage while mounting 2023-07-23 13:49:34 +02:00
jfs_imap.c jfs: reject on-disk inodes of an unsupported type 2025-08-15 12:04:50 +02:00
jfs_imap.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_incore.h jfs: define xtree root and page independently 2025-05-02 07:47:08 +02:00
jfs_inode.c inode: make init and permission helpers idmapped mount aware 2021-01-24 14:27:16 +01:00
jfs_inode.h jfs: convert to fileattr 2021-04-12 15:04:29 +02:00
jfs_lock.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_logmgr.c fs/jfs: Remove dead code 2022-04-25 14:00:33 -05:00
jfs_logmgr.h jfs: delete duplicated words + other fixes 2020-11-13 13:36:00 -06:00
jfs_metapage.c jfs: Remove check for PageUptodate 2022-06-29 08:51:07 -04:00
jfs_metapage.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_mount.c jfs: fix uaf in jfs_evict_inode 2024-02-05 20:12:48 +00:00
jfs_superblock.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_txnmgr.c jfs: define xtree root and page independently 2025-05-02 07:47:08 +02:00
jfs_txnmgr.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_types.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_umount.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_unicode.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_unicode.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_uniupr.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
jfs_xattr.h jfs: Replace zero-length array with flexible-array member 2020-03-09 15:18:51 -05:00
jfs_xtree.c jfs: define xtree root and page independently 2025-05-02 07:47:08 +02:00
jfs_xtree.h jfs: define xtree root and page independently 2025-05-02 07:47:08 +02:00
Kconfig docs: fix a couple of new broken references 2019-07-31 14:12:26 -06:00
Makefile fs/jfs: Remove dead code 2022-04-25 14:00:33 -05:00
namei.c FS: JFS: Fix null-ptr-deref Read in txBegin 2023-07-27 08:50:33 +02:00
resize.c jfs: use sb_bdev_nr_blocks 2021-10-18 14:43:23 -06:00
super.c block: remove QUEUE_FLAG_DISCARD 2022-04-17 19:49:59 -06:00
symlink.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
xattr.c jfs: fix slab-out-of-bounds read in ea_get() 2025-04-10 14:33:43 +02:00