Re: [Jfs-discussion] [PATCH] jfs: check if dmt_leafidx is less than zero

[Dave Kleikamp <dave.kleikamp@oracle.com>]

On 7/26/24 9:22AM, Edward Adam Davis via Jfs-discussion wrote:
> syzbot report a out of bounds in dbSplit, it because dmt_leafidx less
> than 0, add a checking for dmt_leafidx in dbAllocDmapLev.

This addresses the particular case, but I wonder if it would be a little 
more robust to move the check into dbFindLeaf(). It would also catch a 
similar issue when called from dbFindCtl().

> 
> Reported-by: syzbot+dca05492eff41f604890@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=dca05492eff41f604890
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
>   fs/jfs/jfs_dmap.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index cb3cda1390ad..c5b8883599e3 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -1956,6 +1956,7 @@ dbAllocDmapLev(struct bmap * bmp,
>   {
>   	s64 blkno;
>   	int leafidx, rc;
> +	dmtree_t *tp = (dmtree_t *) &dp->tree;
>   
>   	/* can't be more than a dmaps worth of blocks */
>   	assert(l2nb <= L2BPERDMAP);
> @@ -1964,10 +1965,10 @@ dbAllocDmapLev(struct bmap * bmp,
>   	 * free space.  if sufficient free space is found, dbFindLeaf()
>   	 * returns the index of the leaf at which free space was found.
>   	 */
> -	if (dbFindLeaf((dmtree_t *) &dp->tree, l2nb, &leafidx, false))
> +	if (dbFindLeaf(tp, l2nb, &leafidx, false))
>   		return -ENOSPC;
>   
> -	if (leafidx < 0)
> +	if (leafidx < 0 || le32_to_cpu(tp->dmt_leafidx) < 0)
>   		return -EIO;
>   
>   	/* determine the block number within the file system corresponding