[PATCH] jfs: fix array-index-out-of-bounds in diExtendFS

[PATCH] jfs: fix array-index-out-of-bounds in diExtendFS

[Kery Qi]

Similar to the issue fixed in commit 49f9637aafa6 ("jfs: fix
array-index-out-of-bounds in diNewExt"), the diExtendFS() function
also lacks validation for the AG (allocation group) number.

In diExtendFS(), the variable 'n' is computed from iagp->agstart
which is read from disk. If agstart contains a malicious or corrupted
value, 'n' may exceed the bounds of the im_agctl[] array (size MAXAG),
leading to an out-of-bounds access.

Add a boundary check for 'n' after computation to ensure it falls
within the valid range [0, MAXAG). If the check fails, release the
metapage and return -EIO.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
---
 fs/jfs/jfs_imap.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index ecb8e05b8b84..24b414bffd29 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -2900,6 +2900,11 @@ int diExtendFS(struct inode *ipimap, struct inode *ipbmap)
 
 		agstart = le64_to_cpu(iagp->agstart);
 		n = agstart >> mp->db_agl2size;
+		if (n < 0 || n >= MAXAG) {
+			release_metapage(bp);
+			jfs_error(ipimap->i_sb, "invalid AG number\n");
+			return -EIO;
+		}
 		iagp->agstart = cpu_to_le64((s64)n << mp->db_agl2size);
 
 		/* compute backed inodes */
-- 
2.34.1