[PATCH] jfs: validate dmap parameters in dbMount() and slot chains in jfs_dtree.c

[PATCH] jfs: validate dmap parameters in dbMount() and slot chains in jfs_dtree.c

[Hui Peng]

Fix two filesystem corruption crashes in fs/jfs/:

1. In dbMount() (fs/jfs/jfs_dmap.c), validate db_mapsize > 0, db_numag
   <= MAXAG, db_agheight <= MAX_AGHEIGHT, and db_agwidth > 0 to prevent
   out-of-bounds array indexing on bmp->db_agfree[] and shift UB.
2. In check_dtroot(), check_dtpage(), and jfs_readdir()
   (fs/jfs/jfs_dtree.c), validate directory slot continuation indices to
   prevent cyclic or out-of-bounds slot walks.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index a841cf21da7d..f7d6efe8cec8 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -288,7 +288,8 @@ int dbMount(struct inode *ipbmap)
 	    (bmp->db_agstart > (CTLTREESIZE - 1 - bmp->db_agwidth * (MAXAG - 1))) ||
 	    (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG) ||
 	    (bmp->db_agl2size < 0) ||
-	    ((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) {
+	    (bmp->db_mapsize <= 0) ||
+	    (((bmp->db_mapsize - 1) >> bmp->db_agl2size) >= MAXAG)) {
 		err = -EINVAL;
 		goto err_release_metapage;
 	}
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 8ce6e4458cc2..0a5361804155 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -2968,6 +2968,17 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
 			/* copy name in the additional segment(s) */
 			next = d->next;
 			while (next >= 0) {
+				int max_slot = (p->header.flag & BT_ROOT) ?
+					DTROOTMAXSLOT : p->header.maxslot;
+
+				if (unlikely(next < 1 || next >= max_slot)) {
+					jfs_error(ip->i_sb,
+						  "JFS:Dtree error: ino = %ld, bn=%lld, index = %d\n",
+						  (long)ip->i_ino,
+						  (long long)bn,
+						  i);
+					goto skip_one;
+				}
 				t = (struct dtslot *) & p->slot[next];
 				name_ptr += outlen;
 				d_namleft -= len;
@@ -4343,6 +4354,10 @@ bool check_dtroot(dtroot_t *p)
 		}
 
 		/* The last node in the free list must terminate with next = -1 */
+		if (unlikely(__test_and_set_bit(fsi, bitmap))) {
+			jfs_err("duplicate index%d in slot in dtroot\n", fsi);
+			return false;
+		}
 		if (unlikely(p->slot[fsi].next != -1)) {
 			jfs_err("Bad next:%d of the last slot in dtroot\n",
 					p->slot[fsi].next);
@@ -4376,6 +4391,21 @@ bool check_dtroot(dtroot_t *p)
 			jfs_err("Duplicate index:%d in stbl in dtroot\n", idx);
 			return false;
 		}
+
+		if (idx > 0) {
+			int next = (p->header.flag & BT_LEAF) ?
+				((struct ldtentry *)&p->slot[idx])->next :
+				((struct idtentry *)&p->slot[idx])->next;
+
+			while (next >= 0) {
+				if (unlikely(next < 1 || next >= DTROOTMAXSLOT ||
+					     __test_and_set_bit(next, bitmap))) {
+					jfs_err("Bad continuation slot:%d in dtroot\n", next);
+					return false;
+				}
+				next = p->slot[next].next;
+			}
+		}
 	}
 
 	return true;
@@ -4436,6 +4466,10 @@ bool check_dtpage(dtpage_t *p)
 		}
 
 		/* The last node in the free list must terminate with next = -1 */
+		if (unlikely(__test_and_set_bit(fsi, bitmap))) {
+			jfs_err("duplicate index%d in slot in dtpage\n", fsi);
+			return false;
+		}
 		if (unlikely(p->slot[fsi].next != -1)) {
 			jfs_err("Bad next:%d of the last slot in dtpage\n",
 					p->slot[fsi].next);
@@ -4464,6 +4498,7 @@ bool check_dtpage(dtpage_t *p)
 	 */
 	for (i = 0; i < p->header.nextindex; i++) {
 		int idx = DT_GETSTBL(p)[i];
+		int next;
 
 		/* Check if index is out of valid data slot range */
 		if (unlikely(idx < 1 || idx >= DTPAGEMAXSLOT)) {
@@ -4477,6 +4512,18 @@ bool check_dtpage(dtpage_t *p)
 			jfs_err("Duplicate index:%d in stbl of dtpage\n", idx);
 			return false;
 		}
+
+		next = (p->header.flag & BT_LEAF) ?
+			((struct ldtentry *)&p->slot[idx])->next :
+			((struct idtentry *)&p->slot[idx])->next;
+		while (next >= 0) {
+			if (unlikely(next < 1 || next >= DTPAGEMAXSLOT ||
+				     __test_and_set_bit(next, bitmap))) {
+				jfs_err("Bad continuation slot:%d in dtpage\n", next);
+				return false;
+			}
+			next = p->slot[next].next;
+		}
 	}
 
 	return true;