Description
In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Prevent integer overflow in AG size calculation The JFS filesystem calculates allocation group (AG) size using 1 << l2agsize in dbExtendFS(). When l2agsize exceeds 31 (possible with >2TB aggregates on 32-bit systems), this 32-bit shift operation causes undefined behavior and improper AG sizing. On 32-bit architectures: - Left-shifting 1 by 32+ bits results in 0 due to integer overflow - This creates invalid AG sizes (0 or garbage values) in sbi->bmap->db_agsize - Subsequent block allocations would reference invalid AG structures - Could lead to: - Filesystem corruption during extend operations - Kernel crashes due to invalid memory accesses - Security vulnerabilities via malformed on-disk structures Fix by casting to s64 before shifting: bmp->db_agsize = (s64)1 << l2agsize; This ensures 64-bit arithmetic even on 32-bit architectures. The cast matches the data type of db_agsize (s64) and follows similar patterns in JFS block calculation code. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < dd07a985e2ded47b6c7d69fc93c1fe02977c8454affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 8bb29629a5e4090e1ef7199cb42db04a52802239affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3d8a45f87010a802aa214bf39702ca9d99cbf3baaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 55edbf5dbf60a8195c21e92124c4028939ae16b2affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 7ccf3b35274512b60ecb614e0637e76bd6f2d829affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c802a6a4009f585111f903e810b3be9c6d0da329affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 211ed8f5e39e61f9e4d18edd64ce8005a67a1b2aaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < ec34cdf4f917cc6abd306cf091f8b8361fedac88affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 7fcbf789629cdb9fbf4e2172ce31136cfed11e5eaffected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.4.293 to ≤ 5.4.*unaffected5.10.237 to ≤ 5.10.*unaffected5.15.181 to ≤ 5.15.*unaffected6.1.135 to ≤ 6.1.*unaffected6.6.88 to ≤ 6.6.*unaffected6.12.24 to ≤ 6.12.*unaffected6.13.12 to ≤ 6.13.*unaffected6.14.3 to ≤ 6.14.*unaffected6.15 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/dd07a985e2ded47b6c7d69fc93c1fe02977c8454 ↗
- https://git.kernel.org/stable/c/8bb29629a5e4090e1ef7199cb42db04a52802239 ↗
- https://git.kernel.org/stable/c/3d8a45f87010a802aa214bf39702ca9d99cbf3ba ↗
- https://git.kernel.org/stable/c/55edbf5dbf60a8195c21e92124c4028939ae16b2 ↗
- https://git.kernel.org/stable/c/7ccf3b35274512b60ecb614e0637e76bd6f2d829 ↗
- https://git.kernel.org/stable/c/c802a6a4009f585111f903e810b3be9c6d0da329 ↗
- https://git.kernel.org/stable/c/211ed8f5e39e61f9e4d18edd64ce8005a67a1b2a ↗
- https://git.kernel.org/stable/c/ec34cdf4f917cc6abd306cf091f8b8361fedac88 ↗
- https://git.kernel.org/stable/c/7fcbf789629cdb9fbf4e2172ce31136cfed11e5e ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html ↗