github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

f2fs: reject invalid recovered filename lengths

Browse Source 
Recovery uses raw_inode->i_namelen directly when rebuilding fsynced
dentries. A zero-length name uses no dentry slots, so recovery can
report success without recreating the dentry.

Treat zero-length and oversized recovered names as corruption, mark
NEED_FSCK, and stop recovery with -EFSCORRUPTED.

Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
This commit is contained in:
Wenjie Qi 2026-08-03 19:41:53 +08:00 committed by Jaegeuk Kim
parent 0f046e45af
commit 6dc2b804a0
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
fs/f2fs/recovery.c
View File

@ -116,18 +116,26 @@ static void del_fsync_inode(struct fsync_inode_entry *entry, int drop)
}
static int init_recovered_filename(const struct inode *dir,
struct inode *inode,
struct f2fs_inode *raw_inode,
struct f2fs_filename *fname,
struct qstr *usr_fname)
{
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
int err;
memset(fname, 0, sizeof(*fname));
fname->disk_name.len = le32_to_cpu(raw_inode->i_namelen);
fname->disk_name.name = raw_inode->i_name;
if (WARN_ON(fname->disk_name.len > F2FS_NAME_LEN))
return -ENAMETOOLONG;
if (unlikely(!fname->disk_name.len ||
fname->disk_name.len > F2FS_NAME_LEN)) {
f2fs_err(sbi, "invalid recovered filename length %u for ino %llu",
fname->disk_name.len, inode->i_ino);
set_sbi_flag(sbi, SBI_NEED_FSCK);
f2fs_handle_error(sbi, ERROR_CORRUPTED_INODE);
return -EFSCORRUPTED;
}
if (!IS_ENCRYPTED(dir)) {
usr_fname->name = fname->disk_name.name;
@ -201,7 +209,7 @@ static int recover_dentry(struct inode *inode, struct folio *ifolio,
}
dir = entry->inode;
err = init_recovered_filename(dir, raw_inode, &fname, &usr_fname);
err = init_recovered_filename(dir, inode, raw_inode, &fname, &usr_fname);
if (err)
goto out;
retry: