jfs: fix out-of-bounds in dbNextAG() and diAlloc()

In dbNextAG() , there is no check for the case where bmp->db_numag is
greater or same than MAXAG due to a polluted image, which causes an
out-of-bounds. Therefore, a bounds check should be added in dbMount().

And in dbNextAG(), a check for the case where agpref is greater than
bmp->db_numag should be added, so an out-of-bounds exception should be
prevented.

Additionally, a check for the case where agno is greater or same than
MAXAG should be added in diAlloc() to prevent out-of-bounds.

Reported-by: Jeongjun Park <aha310510@gmail.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index ccdfa38d7a6824cbc3530e086ad3abf481dbfbbe..8847e8c5d5b4532d8c0bd9f8ef0c94011ee3e6de 100644 (file)
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -187,7 +187,7 @@ int dbMount(struct inode *ipbmap)
        }
 
        bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag);
-       if (!bmp->db_numag) {
+       if (!bmp->db_numag || bmp->db_numag >= MAXAG) {
                err = -EINVAL;
                goto err_release_metapage;
        }
@@ -652,7 +652,7 @@ int dbNextAG(struct inode *ipbmap)
         * average free space.
         */
        for (i = 0 ; i < bmp->db_numag; i++, agpref++) {
-               if (agpref == bmp->db_numag)
+               if (agpref >= bmp->db_numag)
                        agpref = 0;
 
                if (atomic_read(&bmp->db_active[agpref]))

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 1407feccbc2d05abec0b6be7ffaab32b5f44b7cd..a360b24ed320c0eccd577019d632c228e7981e2f 100644 (file)
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -1360,7 +1360,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)
        /* get the ag number of this iag */
        agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb));
        dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag;
-       if (agno < 0 || agno > dn_numag)
+       if (agno < 0 || agno > dn_numag || agno >= MAXAG)
                return -EIO;
 
        if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) {