[PATCH] jfs: fix out-of-bounds write on symlink inode with negative i_size

[PATCH] jfs: fix out-of-bounds write on symlink inode with negative i_size

[Dmitry Morgun]

i_size is read from disk without validation: diRead() calls
read_metapage() to get a struct dinode from the on-disk image, then
copy_from_dinode() assigns ip->i_size = le64_to_cpu(dip->di_size)
directly. In jfs_iget(), i_size is checked only against the upper
bound IDATASIZE using a signed comparison, so a negative i_size
passes through to the fast symlink path. There, pointer arithmetic
with the negative offset produces an invalid address far outside
the buffer, causing a kernel crash.

Add an explicit check for negative i_size that returns -EIO,
consistent with how other invalid inode states are handled in the
same function.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: d69e83d99cf8 ("jfs: ensure symlinks are NUL-terminated")
Signed-off-by: Dmitry Morgun <d.morgun@ispras.ru>
---
 fs/jfs/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 4066d263e9e1..bf940b2c623f 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -19,6 +19,7 @@
 #include "jfs_unicode.h"
 #include "jfs_debug.h"
 #include "jfs_dmap.h"
+#include "jfs_superblock.h"
 
 
 struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
@@ -50,6 +51,11 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
 			inode->i_op = &page_symlink_inode_operations;
 			inode_nohighmem(inode);
 			inode->i_mapping->a_ops = &jfs_aops;
+		} else if (inode->i_size < 0) {
+			jfs_error(inode->i_sb, "symlink inode has invalid i_size %lld\n",
+				  inode->i_size);
+			iget_failed(inode);
+			return ERR_PTR(-EIO);
 		} else {
 			inode->i_op = &jfs_fast_symlink_inode_operations;
 			inode->i_link = JFS_IP(inode)->i_inline;
-- 
2.34.1