Forwarded: [PATCH] UBSAN: array-index-out-of-bounds in dbFindLeaf (2)

[syzbot <syzbot+1afe7ef2d0062e19eeb3@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] UBSAN: array-index-out-of-bounds in dbFindLeaf (2)
Author: jchuang26@m.fudan.edu.cn

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f0b9d8eb98dfee8d00419aa07543bdc2c1a44fb1

Reported-by: syzbot+1afe7ef2d0062e19eeb3@syzkaller.appspotmail.com

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index cdfa699cd..53642b1ec 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -2971,7 +2971,11 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
 			/* sufficient free space found.  move to the next
 			 * level (or quit if this is the last level).
 			 */
-			if (x + n > max_size)
+			/* stree[] holds max_size entries, so max_size is
+			 * already one past the last valid index.  Use >=
+			 * to reject it and avoid an out-of-bounds read.
+			 */
+			if (x + n >= max_size)
 				return -ENOSPC;
 			if (l2nb <= tp->dmt_stree[x + n])
 				break;