Patch "fs: jfs: fix shift-out-of-bounds in dbDiscardAG" has been added to the 4.19-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    fs: jfs: fix shift-out-of-bounds in dbDiscardAG

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     fs-jfs-fix-shift-out-of-bounds-in-dbdiscardag.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3d338801e30ddef66e66b6120b88a534411a402b
Author: Hoi Pok Wu <wuhoipok@xxxxxxxxx>
Date:   Tue Oct 25 23:20:45 2022 +0800

    fs: jfs: fix shift-out-of-bounds in dbDiscardAG
    
    [ Upstream commit 25e70c6162f207828dd405b432d8f2a98dbf7082 ]
    
    This should be applied to most URSAN bugs found recently by syzbot,
    by guarding the dbMount. As syzbot feeding rubbish into the bmap
    descriptor.
    
    Signed-off-by: Hoi Pok Wu <wuhoipok@xxxxxxxxx>
    Signed-off-by: Dave Kleikamp <dave.kleikamp@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 4f72f7dee78b..f06796cad9aa 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -211,6 +211,11 @@ int dbMount(struct inode *ipbmap)
 		goto err_release_metapage;
 	}
 
+	if (((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) {
+		err = -EINVAL;
+		goto err_release_metapage;
+	}
+
 	for (i = 0; i < MAXAG; i++)
 		bmp->db_agfree[i] = le64_to_cpu(dbmp_le->dn_agfree[i]);
 	bmp->db_agsize = le64_to_cpu(dbmp_le->dn_agsize);