[PATCH] omfs: reject clear ranges past the bitmap map array

[PATCH] omfs: reject clear ranges past the bitmap map array

[David Lee]

OMFS stores the in-memory block bitmap as an array of bitmap-block
pointers in s_imap. A clear request is valid only if every bit in the
requested run belongs to one of those bitmap blocks before set_run()
walks the run and updates sbi->s_imap[map].

omfs_clear_range() currently validates only the starting map. A
corrupted extent can start on the final valid bit of the final bitmap
block and request more than one block. set_run() then increments map and
dereferences sbi->s_imap[map] past the allocated pointer array.

Return before set_run() for non-positive counts. For positive counts,
compute how many bitmap bits remain after the starting bit and reject
clear ranges that would cross beyond s_imap_size.

Fixes: 36cc410a6799 ("omfs: add bitmap routines")
Signed-off-by: David Lee <david.lee@trailofbits.com>
Assisted-by: Codex:gpt-5.5
---
Trail of Bits has a reproducer that triggers a KASAN slab out-of-bounds
report and can be shared if needed.

 fs/omfs/bitmap.c |    7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/omfs/bitmap.c b/fs/omfs/bitmap.c
index 7147ba6a6afc..6420a3034a82 100644
--- a/fs/omfs/bitmap.c
+++ b/fs/omfs/bitmap.c
@@ -177,15 +177,22 @@ int omfs_clear_range(struct super_block *sb, u64 block, int count)
 	struct omfs_sb_info *sbi = OMFS_SB(sb);
 	int bits_per_entry = 8 * sb->s_blocksize;
 	u64 tmp;
+	u64 bits_left;
 	unsigned int map, bit;
 	int ret;
 
+	if (count <= 0)
+		return 0;
+
 	tmp = block;
 	bit = do_div(tmp, bits_per_entry);
 	map = tmp;
 
 	if (map >= sbi->s_imap_size)
 		return 0;
+	bits_left = (u64)(sbi->s_imap_size - map) * bits_per_entry - bit;
+	if (count > bits_left)
+		return -EIO;
 
 	mutex_lock(&sbi->s_bitmap_lock);
 	ret = set_run(sb, map, bits_per_entry, bit, count, 0);