pm24.git/fs/jfs, branch master

Merge tag 'jfs-6.13' of github.com:kleikamp/linux-shaggy

2024-11-21T17:59:59Z

Pull jfs updates from Dave Kleikamp: "A few more patches to add sanity checks in jfs" * tag 'jfs-6.13' of github.com:kleikamp/linux-shaggy: jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree jfs: xattr: check invalid xattr size more strictly jfs: fix array-index-out-of-bounds in jfs_readdir jfs: fix shift-out-of-bounds in dbSplit jfs: array-index-out-of-bounds fix in dtReadFirst

Merge tag 'vfs-6.13.mount.api' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2024-11-18T17:33:34Z

Pull vfs mount api conversions from Christian Brauner: "Convert adfs, affs, befs, hfs, hfsplus, jfs, and hpfs to the new mount api" * tag 'vfs-6.13.mount.api' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: efs: fix the efs new mount api implementation ubifs: Convert ubifs to use the new mount API hpfs: convert hpfs to use the new mount api jfs: convert jfs to use the new mount api hfsplus: convert hfsplus to use the new mount api hfs: convert hfs to use the new mount api befs: convert befs to use the new mount api affs: convert affs to use the new mount api adfs: convert adfs to use the new mount api

jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree

2024-10-29T22:43:41Z

When the value of lp is 0 at the beginning of the for loop, it will become negative in the next assignment and we should bail out. Reported-by: syzbot+412dea214d8baa3f7483@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=412dea214d8baa3f7483 Tested-by: syzbot+412dea214d8baa3f7483@syzkaller.appspotmail.com Signed-off-by: Nihar Chaithanya Signed-off-by: Dave Kleikamp

jfs: xattr: check invalid xattr size more strictly

2024-10-29T22:17:43Z

Commit 7c55b78818cf ("jfs: xattr: fix buffer overflow for invalid xattr") also addresses this issue but it only fixes it for positive values, while ea_size is an integer type and can take negative values, e.g. in case of a corrupted filesystem. This still breaks validation and would overflow because of implicit conversion from int to size_t in print_hex_dump(). Fix this issue by clamping the ea_size value instead. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Cc: stable@vger.kernel.org Signed-off-by: Artem Sadovnikov Signed-off-by: Dave Kleikamp

jfs: fix array-index-out-of-bounds in jfs_readdir

2024-10-29T22:03:41Z

The stbl might contain some invalid values. Added a check to return error code in that case. Reported-by: syzbot+0315f8fe99120601ba88@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0315f8fe99120601ba88 Signed-off-by: Ghanshyam Agrawal Signed-off-by: Dave Kleikamp

jfs: fix shift-out-of-bounds in dbSplit

2024-10-29T21:53:18Z

When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself. Reported-by: syzbot+b5ca8a249162c4b9a7d0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ca8a249162c4b9a7d0 Signed-off-by: Ghanshyam Agrawal Signed-off-by: Dave Kleikamp

jfs: array-index-out-of-bounds fix in dtReadFirst

2024-10-29T21:13:36Z

The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. Reported-by: syzbot+65fa06e29859e41a83f3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=65fa06e29859e41a83f3 Signed-off-by: Ghanshyam Agrawal Signed-off-by: Dave Kleikamp

jfs: Fix sanity check in dbMount

2024-10-22T14:40:37Z

MAXAG is a legitimate value for bmp->db_numag Fixes: e63866a47556 ("jfs: fix out-of-bounds in dbNextAG() and diAlloc()") Signed-off-by: Dave Kleikamp

jfs: convert jfs to use the new mount api

2024-10-08T12:41:53Z

Convert the jfs filesystem to use the new mount API. Tested by comparing random mount & remount options before and after the change. Signed-off-by: Eric Sandeen Link: https://lore.kernel.org/r/20240926171947.682881-1-sandeen@redhat.com Signed-off-by: Christian Brauner

Merge tag 'jfs-6.12' of github.com:kleikamp/linux-shaggy

2024-09-19T04:38:43Z

Pull jfs updates from David Kleikamp: "A few fixes for jfs" * tag 'jfs-6.12' of github.com:kleikamp/linux-shaggy: jfs: Fix uninit-value access of new_ea in ea_buffer jfs: check if leafidx greater than num leaves per dmap tree jfs: Fix uaf in dbFreeBits jfs: fix out-of-bounds in dbNextAG() and diAlloc() jfs: UBSAN: shift-out-of-bounds in dbFindBits