From: Liu Shixin via Jfs-discussion <jfs-discussion@lists.sourceforge.net>

Date: Thu, 3 Nov 2022 11:01:59 +0800

Subject: [PATCH] fs/jfs: fix shift exponent db_agl2size negative

References: bsc#1012628

Patch-mainline: 6.2.5

Git-commit: fad376fce0af58deebc5075b8539dc05bf639af3

[ Upstream commit fad376fce0af58deebc5075b8539dc05bf639af3 ]

As a shift exponent, db_agl2size can not be less than 0. Add the missing

check to fix the shift-out-of-bounds bug reported by syzkaller:

 UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:2227:15

 shift exponent -744642816 is negative

Reported-by: syzbot+0be96567042453c0c820@syzkaller.appspotmail.com

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

Signed-off-by: Liu Shixin <liushixin2@huawei.com>

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>

Signed-off-by: Sasha Levin <sashal@kernel.org>

Signed-off-by: Jiri Slaby <jslaby@suse.cz>

---

 fs/jfs/jfs_dmap.c | 3 ++-

 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c

index 76583857..a3eb1e82 100644

--- a/fs/jfs/jfs_dmap.c

+++ b/fs/jfs/jfs_dmap.c

@@ -193,7 +193,8 @@ int dbMount(struct inode *ipbmap)

 	bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth);

 	bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart);

 	bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size);

-	if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG) {

+	if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG ||

+	    bmp->db_agl2size < 0) {

 		err = -EINVAL;

 		goto err_release_metapage;

 	}

-- 

2.35.3