sugar/linux
1
0
Fork 0
Code Activity

Merge tag 'jfs-6.16' of github.com:kleikamp/linux-shaggy

Browse Source 
Pull jfs updates from David Kleikamp:
 "A few small fixes for jfs"

* tag 'jfs-6.16' of github.com:kleikamp/linux-shaggy:
  jfs: fix array-index-out-of-bounds read in add_missing_indices
  jfs: Fix null-ptr-deref in jfs_ioc_trim
  jfs: validate AG parameters in dbMount() to prevent crashes
This commit is contained in:
Linus Torvalds
2025-05-28 13:36:38 -07:00
parent b1fd8bd0cc 5dff41a863
commit 1cbf99e47f
3 changed files with 22 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
fs/jfs/jfs_discard.c
View File

@@ -86,7 +86,8 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)
down_read(&sb->s_umount);
bmp = JFS_SBI(ip->i_sb)->bmap;
if (minlen > bmp->db_agsize ||
if (bmp == NULL ||
minlen > bmp->db_agsize ||
start >= bmp->db_mapsize ||
range->len < sb->s_blocksize) {
up_read(&sb->s_umount);

6
fs/jfs/jfs_dmap.c
View File

@@ -194,7 +194,11 @@ int dbMount(struct inode *ipbmap)
!bmp->db_numag || (bmp->db_numag > MAXAG) ||
(bmp->db_maxag >= MAXAG) || (bmp->db_maxag < 0) ||
(bmp->db_agpref >= MAXAG) || (bmp->db_agpref < 0) ||
!bmp->db_agwidth ||
(bmp->db_agheight < 0) || (bmp->db_agheight > (L2LPERCTL >> 1)) ||
(bmp->db_agwidth < 1) || (bmp->db_agwidth > (LPERCTL / MAXAG)) ||
(bmp->db_agwidth > (1 << (L2LPERCTL - (bmp->db_agheight << 1)))) ||
(bmp->db_agstart < 0) ||
(bmp->db_agstart > (CTLTREESIZE - 1 - bmp->db_agwidth * (MAXAG - 1))) ||
(bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG) ||
(bmp->db_agl2size < 0) ||
((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) {

18
fs/jfs/jfs_dtree.c
View File

@@ -2613,7 +2613,7 @@ void dtInitRoot(tid_t tid, struct inode *ip, u32 idotdot)
* fsck.jfs should really fix this, but it currently does not.
* Called from jfs_readdir when bad index is detected.
*/
static void add_missing_indices(struct inode *inode, s64 bn)
static int add_missing_indices(struct inode *inode, s64 bn)
{
struct ldtentry *d;
struct dt_lock *dtlck;
@@ -2622,7 +2622,7 @@ static void add_missing_indices(struct inode *inode, s64 bn)
struct lv *lv;
struct metapage *mp;
dtpage_t *p;
int rc;
int rc = 0;
s8 *stbl;
tid_t tid;
struct tlock *tlck;
@@ -2647,6 +2647,16 @@ static void add_missing_indices(struct inode *inode, s64 bn)
stbl = DT_GETSTBL(p);
for (i = 0; i < p->header.nextindex; i++) {
if (stbl[i] < 0) {
jfs_err("jfs: add_missing_indices: Invalid stbl[%d] = %d for inode %ld, block = %lld",
i, stbl[i], (long)inode->i_ino, (long long)bn);
rc = -EIO;
DT_PUTPAGE(mp);
txAbort(tid, 0);
goto end;
}
d = (struct ldtentry *) &p->slot[stbl[i]];
index = le32_to_cpu(d->index);
if ((index < 2) || (index >= JFS_IP(inode)->next_index)) {
@@ -2664,6 +2674,7 @@ static void add_missing_indices(struct inode *inode, s64 bn)
(void) txCommit(tid, 1, &inode, 0);
end:
txEnd(tid);
return rc;
}
/*
@@ -3017,7 +3028,8 @@ skip_one:
}
if (fix_page) {
add_missing_indices(ip, bn);
if ((rc = add_missing_indices(ip, bn)))
goto out;
page_fixed = 1;
}