From 3f6df9ae1b5e4ae2278200cbf670ff32dbe8f4e1 Mon Sep 17 00:00:00 2001 From: Ryusuke Konishi Date: Fri, 4 Sep 2026 02:23:58 +0900 Subject: [PATCH] nilfs2: strengthen consistency checks in nilfs_direct_propagate() nilfs_direct_propagate() is responsible for updating the virtual block number associated with a dirty data block in the direct mapping. It is not designed to handle intermediate node blocks. Furthermore, it assumes that the block offset of the passed buffer head is within the range of NILFS_DIRECT_KEY_MAX; otherwise, an out-of-bounds memory access could occur within the inode containing the bmap root. While such inconsistencies stem from bugs, they can cause silent, harmful side effects unless a debug kernel is used - as was the case with a recent slab out-of-bounds access issue found in this function. Therefore, issue a kernel warning via WARN_ON_ONCE() and return -EINVAL for these anomalies, allowing the bmap layer to handle the situation as a filesystem error. Signed-off-by: Ryusuke Konishi Signed-off-by: Viacheslav Dubeyko --- fs/nilfs2/direct.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c index b8643d3aa2f8..64da677dc8d4 100644 --- a/fs/nilfs2/direct.c +++ b/fs/nilfs2/direct.c @@ -270,8 +270,14 @@ static int nilfs_direct_propagate(struct nilfs_bmap *bmap, if (!NILFS_BMAP_USE_VBN(bmap)) return 0; + if (WARN_ON_ONCE(buffer_nilfs_node(bh))) + return -EINVAL; + dat = nilfs_bmap_get_dat(bmap); key = nilfs_bmap_data_get_key(bmap, bh); + if (WARN_ON_ONCE(key > NILFS_DIRECT_KEY_MAX)) + return -EINVAL; + ptr = nilfs_direct_get_ptr(bmap, key); if (ptr == NILFS_BMAP_INVALID_PTR) return -EINVAL;