From 7566fec606d233f803e61f5ce37c54fbcdb00010 Mon Sep 17 00:00:00 2001 From: Seongjae Jeong Date: Fri, 18 Sep 2026 13:39:22 +0000 Subject: [PATCH] f2fs: reject device aliasing without a multi-device configuration A malformed F2FS image can enable F2FS_FEATURE_DEVICE_ALIAS without providing a multi-device configuration. For a regular single-device filesystem, f2fs_scan_devices() returns without allocating sbi->devs. In this state, f2fs_dev_is_alloc_blocked() passes the device alias feature check and dereferences FDEV(0), resulting in a NULL pointer dereference during segment allocation. Device aliasing requires at least one secondary device. Reject superblocks that enable device aliasing without entries for both the main and secondary devices in sanity_check_raw_super(). Fixes: eae3faf210bd ("f2fs: support dynamic reserve/release for device aliasing") Reported-by: syzbot+ae5b8eb92ed40411ce16@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ae5b8eb92ed40411ce16 Signed-off-by: Seongjae Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim --- fs/f2fs/super.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index fc3be097285b..00da08504d55 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -4154,6 +4154,12 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi, return -EFSCORRUPTED; } + if (__F2FS_HAS_FEATURE(raw_super, F2FS_FEATURE_DEVICE_ALIAS) && + (!RDEV(0).path[0] || !RDEV(1).path[0])) { + f2fs_info(sbi, "Device aliasing requires a multi-device configuration"); + return -EFSCORRUPTED; + } + if (RDEV(0).path[0]) { block_t dev_seg_count = le32_to_cpu(RDEV(0).total_segments); int i = 1;