Skip to content

Commit ddf2846

Browse files
ea1daviskleikamp
authored andcommitted
jfs: add sanity check for agwidth in dbMount
The width in dmapctl of the AG is zero, it trigger a divide error when calculating the control page level in dbAllocAG. To avoid this issue, add a check for agwidth in dbAllocAG. Reported-and-tested-by: syzbot+7c808908291a569281a9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7c808908291a569281a9 Signed-off-by: Edward Adam Davis <eadavis@qq.com> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
1 parent b61e69b commit ddf2846

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

fs/jfs/jfs_dmap.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,10 @@ int dbMount(struct inode *ipbmap)
204204
bmp->db_aglevel = le32_to_cpu(dbmp_le->dn_aglevel);
205205
bmp->db_agheight = le32_to_cpu(dbmp_le->dn_agheight);
206206
bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth);
207+
if (!bmp->db_agwidth) {
208+
err = -EINVAL;
209+
goto err_release_metapage;
210+
}
207211
bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart);
208212
bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size);
209213
if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG ||

0 commit comments

Comments
 (0)