CVE-2025-37858: a 64-bit destination cannot fix a narrow shift

Where the calculation went wrong

CVE-2025-37858 concerns allocation-group sizing in dbExtendFS(), in fs/jfs/jfs_dmap.c. The calculation used 1 << l2agsize. The Linux CVE announcement describes shift counts above 31 on 32-bit systems, producing undefined behavior and invalid allocation-group sizes.

The subtle point is the expression itself. The integer literal 1 does not become a 64-bit operand because the result will be stored in a wider field. The shift is evaluated first; assignment follows. Reviewing only the destination type misses the operation that creates the value.

Widen the operand before shifting

The correction casts the left operand to s64 before the shift. That makes the operation use the intended width and matches the allocation-group size field. The following comparison shows the expression change documented in the announcement.

Casting the completed expression would happen too late. The same distinction deserves attention in multiplication and allocation-size calculations. A wider intermediate type also needs an appropriate range check; widening alone does not make every possible input safe.

- bmp->db_agsize = 1 << l2agsize;
+ bmp->db_agsize = (s64)1 << l2agsize;

Review the intermediate values

Write down the effective operand types, signedness and valid input range for each size calculation. Check the expression before assignment, including promotions and explicit casts. Review both supported 32-bit and 64-bit configurations where they affect the types or build behavior.

Boundary tests should exercise the values around the intended limit and assert the resulting size or rejection. Sanitizers and static analysis can support this work, but the reviewer still needs to connect the arithmetic to the assumptions of the next operation.

Why this matters beyond filesystems

The public announcement describes possible filesystem corruption and kernel crashes from invalid group sizing. It does not establish the impact of a superficially similar expression in your application; that requires tracing the result to its consumers.

This review pattern is useful in native applications handling lengths, offsets, buffers and untrusted file metadata. A scoped security code review can examine the calculation and the memory or storage operations it controls. For deployed Linux packages, use the current CVE record and vendor advisory to determine the fix status.