[PATCH v5 1/6] qnx6: validate di_filelevels in qnx6_iget() before accessing level pointers

[Hui Peng <benquike@gmail.com>]

In qnx6_iget(), raw_inode->di_filelevels is loaded directly from disk
without checking if it exceeds QNX6_PTR_MAX_LEVELS (3). When di_filelevels
exceeds 3 (for example, 6 or 255), qnx6_block_map() triggers UBSAN
shift-out-of-bounds reports at both shifts during indirect block tree
traversal.

Validate raw_inode->di_filelevels <= QNX6_PTR_MAX_LEVELS in qnx6_iget()
and return -EIO on invalid values.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Tested-by: Matthias Goergens <matthias.goergens@gmail.com>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v5:
- Restored commit description to accurately specify UBSAN
  shift-out-of-bounds reports at both shifts in qnx6_block_map() per
  Matthias Goergens.
- Added Tested-by: Matthias Goergens.

 fs/qnx6/inode.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/qnx6/inode.c b/fs/qnx6/inode.c
index a350280f2d47..eb6b5dfbc599 100644
--- a/fs/qnx6/inode.c
+++ b/fs/qnx6/inode.c
@@ -543,6 +543,11 @@ struct inode *qnx6_iget(struct super_block *sb, unsigned int ino)
 
 	raw_inode = qnx6_raw_inode(sb, ino, bh);
 	inode->i_mode = fs16_to_cpu(sbi, raw_inode->di_mode);
+	if (raw_inode->di_filelevels > QNX6_PTR_MAX_LEVELS) {
+		pr_err("invalid inode levels %d (max %d)\n",
+		       raw_inode->di_filelevels, QNX6_PTR_MAX_LEVELS);
+		goto bad_inode;
+	}
 	i_uid_write(inode, fs32_to_cpu(sbi, raw_inode->di_uid));
 	i_gid_write(inode, fs32_to_cpu(sbi, raw_inode->di_gid));
 	set_nlink(inode, fs32_to_cpu(sbi, raw_inode->di_nlink));
-- 
2.47.3