github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nilfs2: strengthen consistency checks in nilfs_direct_propagate()

Browse Source 
nilfs_direct_propagate() is responsible for updating the virtual block
number associated with a dirty data block in the direct mapping.

It is not designed to handle intermediate node blocks.  Furthermore, it
assumes that the block offset of the passed buffer head is within the
range of NILFS_DIRECT_KEY_MAX; otherwise, an out-of-bounds memory access
could occur within the inode containing the bmap root.

While such inconsistencies stem from bugs, they can cause silent,
harmful side effects unless a debug kernel is used - as was the case
with a recent slab out-of-bounds access issue found in this function.

Therefore, issue a kernel warning via WARN_ON_ONCE() and return -EINVAL
for these anomalies, allowing the bmap layer to handle the situation as
a filesystem error.

Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
This commit is contained in:
Ryusuke Konishi 2026-09-04 02:23:58 +09:00 committed by Viacheslav Dubeyko
parent cee9395acd
commit 3f6df9ae1b
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
fs/nilfs2/direct.c
View File

@ -270,8 +270,14 @@ static int nilfs_direct_propagate(struct nilfs_bmap *bmap,
if (!NILFS_BMAP_USE_VBN(bmap))
return 0;
if (WARN_ON_ONCE(buffer_nilfs_node(bh)))
return -EINVAL;
dat = nilfs_bmap_get_dat(bmap);
key = nilfs_bmap_data_get_key(bmap, bh);
if (WARN_ON_ONCE(key > NILFS_DIRECT_KEY_MAX))
return -EINVAL;
ptr = nilfs_direct_get_ptr(bmap, key);
if (ptr == NILFS_BMAP_INVALID_PTR)
return -EINVAL;