]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
jfs: fix divide error in dbNextAG
authorPavel Skripkin <paskripkin@gmail.com>
Sat, 19 Mar 2022 19:30:00 +0000 (22:30 +0300)
committerStefan Bader <stefan.bader@canonical.com>
Fri, 20 May 2022 12:39:34 +0000 (14:39 +0200)
commitb8ed10104dbf5c2defa5a7cecf8a3646229d1cf8
treef946283183e87260cabecf8d18f2fe0725fcf4b2
parente7466917c7f396aa03cf96f874e75dd942dde786
jfs: fix divide error in dbNextAG

BugLink: https://bugs.launchpad.net/bugs/1969110
[ Upstream commit 2cc7cc01c15f57d056318c33705647f87dcd4aab ]

Syzbot reported divide error in dbNextAG(). The problem was in missing
validation check for malicious image.

Syzbot crafted an image with bmp->db_numag equal to 0. There wasn't any
validation checks, but dbNextAG() blindly use bmp->db_numag in divide
expression

Fix it by validating bmp->db_numag in dbMount() and return an error if
image is malicious

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+46f5c25af73eb8330eb6@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 6bbfe9a715ea075114213c6c8b30dbd2adc9624d)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
fs/jfs/jfs_dmap.c