diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 8f85177f284b..4e29f8c7d624 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -2128,6 +2128,13 @@ int dtDelete(tid_t tid, next_index = -1; else { stbl = DT_GETSTBL(np); + + if (stbl[0] < 0 || stbl[0] > 127) { + DT_PUTPAGE(mp); + jfs_error(ip->i_sb, "stbl[0] out of bound\n"); + return -EIO; + } + ldtentry = (struct ldtentry *) & np-> slot[stbl[0]];