* [PATCH] jfs: fix oob in dbFindLeaf
2026-01-08 13:00 [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dbFindLeaf (2) syzbot
@ 2026-01-08 14:45 ` Edward Adam Davis
2026-04-17 10:11 ` Forwarded: [PATCH] jfs: fix off-by-one in dbFindLeaf tree bounds check syzbot
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Edward Adam Davis @ 2026-01-08 14:45 UTC (permalink / raw)
To: syzbot+1afe7ef2d0062e19eeb3
Cc: jfs-discussion, linux-kernel, shaggy, syzkaller-bugs
The initial value of x is ti, and there is a potential risk that the
value of ti might equal max_size. The existing boundary checks have
been improved to prevent the out-of-bounds (OOB) issue [1] reported
by syzbot.
[1]
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2976:16
index 1365 is out of range for type 's8[1365]' (aka 'signed char[1365]')
Call Trace:
dbFindLeaf+0x308/0x520 fs/jfs/jfs_dmap.c:2976
dbFindCtl+0x267/0x520 fs/jfs/jfs_dmap.c:1717
dbAllocAny fs/jfs/jfs_dmap.c:1527 [inline]
Reported-by: syzbot+1afe7ef2d0062e19eeb3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1afe7ef2d0062e19eeb3
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
fs/jfs/jfs_dmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index cdfa699cd7c8..18a7dc58f289 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -2971,7 +2971,7 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
/* sufficient free space found. move to the next
* level (or quit if this is the last level).
*/
- if (x + n > max_size)
+ if (x + n >= max_size)
return -ENOSPC;
if (l2nb <= tp->dmt_stree[x + n])
break;
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread* Forwarded: [PATCH] jfs: fix off-by-one in dbFindLeaf tree bounds check
2026-01-08 13:00 [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dbFindLeaf (2) syzbot
2026-01-08 14:45 ` [PATCH] jfs: fix oob in dbFindLeaf Edward Adam Davis
@ 2026-04-17 10:11 ` syzbot
2026-04-17 16:19 ` Forwarded: Re: [syzbot] UBSAN: array-index-out-of-bounds in dbFindLeaf syzbot
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-04-17 10:11 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] jfs: fix off-by-one in dbFindLeaf tree bounds check
Author: tristmd@gmail.com
From: Tristan Madani <tristan@talencesecurity.com>
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
The bounds check in dbFindLeaf() uses a strict greater-than comparison
(x + n > max_size) to guard access to the dmt_stree[] array. However,
max_size is set to the array size itself (TREESIZE or CTLTREESIZE), so
valid indices are 0 through max_size-1. When x + n equals max_size, the
check passes but the subsequent array access tp->dmt_stree[x + n] reads
one element past the end of the array.
This is reached when a corrupted filesystem image has an invalid
dmt_height value that causes the tree walk loop to descend beyond the
actual tree depth, pushing the starting index ti to exactly max_size.
For the dmapctl case (CTLTREESIZE = 1365), a height of 6 instead of the
valid maximum of 5 produces: ti = 1 -> 5 -> 21 -> 85 -> 341 -> 1365,
and the access at stree[1365] is one past the s8[1365] array.
UBSAN reports:
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2976:16
index 1365 is out of range for type 's8[1365]' (aka 'signed char[1365]')
Fix the off-by-one by changing '>' to '>=' so that the boundary index is
correctly treated as out-of-bounds.
Reported-by: syzbot+1afe7ef2d0062e19eeb3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1afe7ef2d0062e19eeb3
Fixes: 22cad8bc1d36 ("jfs: fix array-index-out-of-bounds in dbFindLeaf")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/jfs/jfs_dmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -3058,7 +3058,7 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
/* sufficient free space found. move to the next
* level (or quit if this is the last level).
*/
- if (x + n > max_size)
+ if (x + n >= max_size)
return -ENOSPC;
if (l2nb <= tp->dmt_stree[x + n])
break;
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread* Forwarded: Re: [syzbot] UBSAN: array-index-out-of-bounds in dbFindLeaf
2026-01-08 13:00 [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dbFindLeaf (2) syzbot
2026-01-08 14:45 ` [PATCH] jfs: fix oob in dbFindLeaf Edward Adam Davis
2026-04-17 10:11 ` Forwarded: [PATCH] jfs: fix off-by-one in dbFindLeaf tree bounds check syzbot
@ 2026-04-17 16:19 ` syzbot
2026-09-14 12:18 ` Forwarded: [PATCH] UBSAN: array-index-out-of-bounds in dbFindLeaf (2) syzbot
2026-09-15 1:38 ` syzbot
4 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-04-17 16:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] UBSAN: array-index-out-of-bounds in dbFindLeaf
Author: tristmd@gmail.com
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>From 9fdbd0cb4943449d1104e60ec721d8dbe92a56ff Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Fri, 17 Apr 2026 16:15:14 +0000
Subject: [PATCH] jfs: fix array-index-out-of-bounds in dbFindLeaf
dbFindLeaf() uses an off-by-one comparison when checking array
bounds: `if (x + n > max_size)` should be `>= max_size` since
array indices are 0-based and max_size is the total element count.
When x + n equals max_size, the access tp->dmt_stree[x + n] reads
one element past the end of the array.
Fix by using >= instead of > in the bounds check.
Reported-by: syzbot+1afe7ef2d0062e19eeb3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1afe7ef2d0062e19eeb3
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/jfs/jfs_dmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index a841cf2..cbdcc8d 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -3058,7 +3058,7 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
/* sufficient free space found. move to the next
* level (or quit if this is the last level).
*/
- if (x + n > max_size)
+ if (x + n >= max_size)
return -ENOSPC;
if (l2nb <= tp->dmt_stree[x + n])
break;
--
2.47.3
^ permalink raw reply [flat|nested] 6+ messages in thread
* Forwarded: [PATCH] UBSAN: array-index-out-of-bounds in dbFindLeaf (2)
2026-01-08 13:00 [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dbFindLeaf (2) syzbot
` (2 preceding siblings ...)
2026-04-17 16:19 ` Forwarded: Re: [syzbot] UBSAN: array-index-out-of-bounds in dbFindLeaf syzbot
@ 2026-09-14 12:18 ` syzbot
2026-09-15 1:38 ` syzbot
4 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-09-14 12:18 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] UBSAN: array-index-out-of-bounds in dbFindLeaf (2)
Author: jchuang26@m.fudan.edu.cn
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f0b9d8eb98dfee8d00419aa07543bdc2c1a44fb1
Reported-by: syzbot+1afe7ef2d0062e19eeb3@syzkaller.appspotmail.com
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index cdfa699cd..53642b1ec 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -2971,7 +2971,11 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
/* sufficient free space found. move to the next
* level (or quit if this is the last level).
*/
- if (x + n > max_size)
+ /* stree[] holds max_size entries, so max_size is
+ * already one past the last valid index. Use >=
+ * to reject it and avoid an out-of-bounds read.
+ */
+ if (x + n >= max_size)
return -ENOSPC;
if (l2nb <= tp->dmt_stree[x + n])
break;
^ permalink raw reply [flat|nested] 6+ messages in thread* Forwarded: [PATCH] UBSAN: array-index-out-of-bounds in dbFindLeaf (2)
2026-01-08 13:00 [syzbot] [jfs?] UBSAN: array-index-out-of-bounds in dbFindLeaf (2) syzbot
` (3 preceding siblings ...)
2026-09-14 12:18 ` Forwarded: [PATCH] UBSAN: array-index-out-of-bounds in dbFindLeaf (2) syzbot
@ 2026-09-15 1:38 ` syzbot
4 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-09-15 1:38 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] UBSAN: array-index-out-of-bounds in dbFindLeaf (2)
Author: jchuang26@m.fudan.edu.cn
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Reported-by: syzbot+1afe7ef2d0062e19eeb3@syzkaller.appspotmail.com
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index cdfa699cd..53642b1ec 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -2971,7 +2971,11 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
/* sufficient free space found. move to the next
* level (or quit if this is the last level).
*/
- if (x + n > max_size)
+ /* stree[] holds max_size entries, so max_size is
+ * already one past the last valid index. Use >=
+ * to reject it and avoid an out-of-bounds read.
+ */
+ if (x + n >= max_size)
return -ENOSPC;
if (l2nb <= tp->dmt_stree[x + n])
break;
^ permalink raw reply [flat|nested] 6+ messages in thread