jfs: fix divide error in dbNextAG
authorPavel Skripkin <paskripkin@gmail.com>
Sat, 19 Mar 2022 19:30:00 +0000 (22:30 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 8 Apr 2022 12:23:51 +0000 (14:23 +0200)
commit6bbfe9a715ea075114213c6c8b30dbd2adc9624d
tree18539b298955045afd7174b38cadf6efc15ed598
parent104852921ff6c87c84b782df46d269db8d2d0595
jfs: fix divide error in dbNextAG

[ Upstream commit 2cc7cc01c15f57d056318c33705647f87dcd4aab ]

Syzbot reported divide error in dbNextAG(). The problem was in missing
validation check for malicious image.

Syzbot crafted an image with bmp->db_numag equal to 0. There wasn't any
validation checks, but dbNextAG() blindly use bmp->db_numag in divide
expression

Fix it by validating bmp->db_numag in dbMount() and return an error if
image is malicious

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+46f5c25af73eb8330eb6@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/jfs/jfs_dmap.c