Edward Adam Davis f98bf80b20 jfs: fix null ptr deref in dtInsertEntry ... commit ce6dede912 upstream. [syzbot reported] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713 ... [Analyze] In dtInsertEntry(), when the pointer h has the same value as p, after writing name in UniStrncpy_to_le(), p->header.flag will be cleared. This will cause the previously true judgment "p->header.flag & BT-LEAF" to change to no after writing the name operation, this leads to entering an incorrect branch and accessing the uninitialized object ih when judging this condition for the second time. [Fix] After got the page, check freelist first, if freelist == 0 then exit dtInsert() and return -EINVAL. Reported-by: syzbot+bba84aef3a26fb93deb9@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com> Signed-off-by: Aditya Dutt <duttaditya18@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-07-17 18:30:48 +02:00
..
acl.c
file.c
inode.c
ioctl.c
jfs_acl.h
jfs_btree.h
jfs_debug.c
jfs_debug.h
jfs_dinode.h	jfs: define xtree root and page independently	2025-05-02 07:44:39 +02:00
jfs_discard.c	jfs: Fix null-ptr-deref in jfs_ioc_trim	2025-06-27 11:05:30 +01:00
jfs_discard.h
jfs_dmap.c	jfs: validate AG parameters in dbMount() to prevent crashes	2025-07-10 15:57:35 +02:00
jfs_dmap.h
jfs_dtree.c	jfs: fix null ptr deref in dtInsertEntry	2025-07-17 18:30:48 +02:00
jfs_dtree.h
jfs_extent.c
jfs_extent.h
jfs_filsys.h
jfs_imap.c	jfs: define xtree root and page independently	2025-05-02 07:44:39 +02:00
jfs_imap.h
jfs_incore.h	jfs: define xtree root and page independently	2025-05-02 07:44:39 +02:00
jfs_inode.c
jfs_inode.h
jfs_lock.h
jfs_logmgr.c
jfs_logmgr.h
jfs_metapage.c
jfs_metapage.h
jfs_mount.c	jfs: fix uaf in jfs_evict_inode	2024-02-23 08:54:39 +01:00
jfs_superblock.h
jfs_txnmgr.c	jfs: define xtree root and page independently	2025-05-02 07:44:39 +02:00
jfs_txnmgr.h
jfs_types.h
jfs_umount.c
jfs_unicode.c
jfs_unicode.h
jfs_uniupr.c
jfs_xattr.h
jfs_xtree.c	jfs: define xtree root and page independently	2025-05-02 07:44:39 +02:00
jfs_xtree.h	jfs: define xtree root and page independently	2025-05-02 07:44:39 +02:00
Kconfig
Makefile
namei.c
resize.c
super.c
symlink.c
xattr.c	jfs: fix slab-out-of-bounds read in ea_get()	2025-04-10 14:32:06 +02:00