jfs: fix divide error in dbNextAG
authorPavel Skripkin <paskripkin@gmail.com>
Sat, 19 Mar 2022 19:30:00 +0000 (22:30 +0300)
committerDave Kleikamp <dave.kleikamp@oracle.com>
Tue, 22 Mar 2022 15:09:13 +0000 (10:09 -0500)
commit2cc7cc01c15f57d056318c33705647f87dcd4aab
tree3a17f1061f6d1cc64a5ec186266ce5bcab2acc29
parentb47d5a4f6b8d42f8a8fbe891b36215e4fddc53be
jfs: fix divide error in dbNextAG

Syzbot reported divide error in dbNextAG(). The problem was in missing
validation check for malicious image.

Syzbot crafted an image with bmp->db_numag equal to 0. There wasn't any
validation checks, but dbNextAG() blindly use bmp->db_numag in divide
expression

Fix it by validating bmp->db_numag in dbMount() and return an error if
image is malicious

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+46f5c25af73eb8330eb6@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
fs/jfs/jfs_dmap.c