]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
jfs: fix divide error in dbNextAG
authorPavel Skripkin <paskripkin@gmail.com>
Sat, 19 Mar 2022 19:30:00 +0000 (22:30 +0300)
committerStefan Bader <stefan.bader@canonical.com>
Fri, 20 May 2022 13:19:14 +0000 (15:19 +0200)
commitf105de615bf148c15a30ee1bbc3dfb221d6239f3
treedc4cf22876599e1fe88d5cbfa7a994d1fe6d86bc
parentd3d6e41cdc93f1719eb990a9d7d6e1940d1ee5eb
jfs: fix divide error in dbNextAG

BugLink: https://bugs.launchpad.net/bugs/1971497
[ Upstream commit 2cc7cc01c15f57d056318c33705647f87dcd4aab ]

Syzbot reported divide error in dbNextAG(). The problem was in missing
validation check for malicious image.

Syzbot crafted an image with bmp->db_numag equal to 0. There wasn't any
validation checks, but dbNextAG() blindly use bmp->db_numag in divide
expression

Fix it by validating bmp->db_numag in dbMount() and return an error if
image is malicious

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+46f5c25af73eb8330eb6@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
fs/jfs/jfs_dmap.c