jfs: fix array-index-out-of-bounds read in add_missing_indices

stbl is s8 but it must contain offsets into slot which can go from 0 to 127.

Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with error if add_missing_indices returns with an error.

Reported-by [email protected]

Closes https://syzkaller.appspot.com./bug?extid=b974bd41515f770c608b

Signed-off-by Aditya Dutt <[email protected]>

---
  fs/jfs/jfs_dtree.c | 20 +++++++++++++++++---
  1 file changed, 17 insertions(+), 3 deletions(-)

fs/jfs/jfs_dtree.c +17 -3

index 93db6eec4465..de33026d18d2 100644
@@ -2613,7 +2613,7 @@ void dtInitRoot(tid_t tid, struct inode *ip, u32 idotdot)
   *	     fsck.jfs should really fix this, but it currently does not.
   *	     Called from jfs_readdir when bad index is detected.
   */
-static void add_missing_indices(struct inode *inode, s64 bn)
+static int add_missing_indices(struct inode *inode, s64 bn)
  {
  	struct ldtentry *d;
  	struct dt_lock *dtlck;

@@ -2622,7 +2622,7 @@ static void add_missing_indices(struct inode *inode, s64 bn)
  	struct lv *lv;
  	struct metapage *mp;
  	dtpage_t *p;
-	int rc;
+	int rc = 0;
  	s8 *stbl;
  	tid_t tid;
  	struct tlock *tlck;

@@ -2647,6 +2647,16 @@ static void add_missing_indices(struct inode *inode, s64 bn)
 
  	stbl = DT_GETSTBL(p);
  	for (i = 0; i < p->header.nextindex; i++) {
+		if (stbl[i] < 0) {
+			jfs_err("jfs: add_missing_indices: Invalid stbl[%d] = %d for inode %ld, block = %lld",
+				i, stbl[i], (long)inode->i_ino, (long long)bn);
+			rc = -EIO;
+
+			DT_PUTPAGE(mp);
+			txAbort(tid, 0);
+			goto end;
+		}
+
  		d = (struct ldtentry *) &p->slot[stbl[i]];
  		index = le32_to_cpu(d->index);
  		if ((index < 2) || (index >= JFS_IP(inode)->next_index)) {

@@ -2664,6 +2674,7 @@ static void add_missing_indices(struct inode *inode, s64 bn)
  	(void) txCommit(tid, 1, &inode, 0);
  end:
  	txEnd(tid);
+	return rc;
  }
 
  /*

@@ -3017,7 +3028,10 @@ int jfs_readdir(struct file *file, struct dir_context *ctx)
  		}
 
  		if (fix_page) {
-			add_missing_indices(ip, bn);
+			if ((rc = add_missing_indices(ip, bn))) {
+				jfs_err("jfs_readdir: add_missing_indices returned %d", rc);
+				goto out;
+			}
  			page_fixed = 1;
  		}
 

base-commit: a8dfb2168906944ea61acfc87846b816eeab882d