Liu Shixin via Jfs-discussion 5d03a19ac7 fs/jfs: fix shift exponent db_agl2size negative ...

[ Upstream commit fad376fce0af58deebc5075b8539dc05bf639af3 ]

As a shift exponent, db_agl2size can not be less than 0. Add the missing
check to fix the shift-out-of-bounds bug reported by syzkaller:

 UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:2227:15
 shift exponent -744642816 is negative

Reported-by: syzbot+0be96567042453c0c820@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-03-11 16:40:08 +01:00

..

acl.c

…

file.c

…

inode.c

jfs: prevent NULL deref in diFree

2022-04-13 21:01:03 +02:00

ioctl.c

…

jfs_acl.h

…

jfs_btree.h

…

jfs_debug.c

proc: convert everything to "struct proc_ops"

2020-02-04 03:05:26 +00:00

jfs_debug.h

…

jfs_dinode.h

…

jfs_discard.c

…

jfs_discard.h

…

jfs_dmap.c

fs/jfs: fix shift exponent db_agl2size negative

2023-03-11 16:40:08 +01:00

jfs_dmap.h

jfs: Fix array index bounds check in dbAdjTree

2020-12-30 11:54:18 +01:00

jfs_dtree.c

jfs: Replace zero-length array with flexible-array member

2020-03-09 15:18:51 -05:00

jfs_dtree.h

…

jfs_extent.c

…

jfs_extent.h

…

jfs_filsys.h

JFS: more checks for invalid superblock

2021-03-07 12:34:04 +01:00

jfs_imap.c

…

jfs_imap.h

…

jfs_incore.h

…

jfs_inode.c

…

jfs_inode.h

…

jfs_lock.h

…

jfs_logmgr.c

fs/jfs: Fix missing error code in lmLogInit()

2021-07-20 16:05:40 +02:00

jfs_logmgr.h

…

jfs_metapage.c

fs: Introduce i_blocks_per_page

2020-09-21 08:59:26 -07:00

jfs_metapage.h

…

jfs_mount.c

JFS: fix memleak in jfs_mount

2021-11-18 14:04:15 +01:00

jfs_superblock.h

…

jfs_txnmgr.c

…

jfs_txnmgr.h

…

jfs_types.h

…

jfs_umount.c

…

jfs_unicode.c

…

jfs_unicode.h

…

jfs_uniupr.c

…

jfs_xattr.h

jfs: Replace zero-length array with flexible-array member

2020-03-09 15:18:51 -05:00

jfs_xtree.c

…

jfs_xtree.h

…

Kconfig

…

Makefile

…

namei.c

…

resize.c

block: move struct block_device to blk_types.h

2020-06-24 09:16:02 -06:00

super.c

…

symlink.c

…

xattr.c

…