github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nilfs2: validate file block counts during recovery

Browse Source 
nilfs_scan_dsync_log() trusts the block counts in each on-disk file
information entry. If fi_ndatablk is greater than fi_nblocks, the data
block loop can consume excessive summary entries and the later subtraction
used to derive the number of node blocks underflows.

Reject inconsistent file information entries before consuming their block
information.

Fixes: 0f3e1c7f23 ("nilfs2: recovery functions")
Cc: stable+noautosel@kernel.org # Non-fatal bug fix; defer backport until a real issue is reported
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
This commit is contained in:
Aldo Ariel Panzardo 2026-09-15 08:13:51 -03:00 committed by Viacheslav Dubeyko
parent cb6702e63e
commit 8393ce53a5
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
fs/nilfs2/recovery.c
View File

@ -322,6 +322,7 @@ static void nilfs_skip_summary_info(struct the_nilfs *nilfs,
*
* Return: 0 on success, or one of the following negative error codes on
* failure:
* * %-EINVAL - Invalid block counts in a file information entry.
* * %-EIO - I/O error.
* * %-ENOMEM - Insufficient memory available.
*/
@ -359,6 +360,10 @@ static int nilfs_scan_dsync_log(struct the_nilfs *nilfs, sector_t start_blocknr,
ino = le64_to_cpu(finfo->fi_ino);
nblocks = le32_to_cpu(finfo->fi_nblocks);
ndatablk = le32_to_cpu(finfo->fi_ndatablk);
if (ndatablk > nblocks) {
err = -EINVAL;
goto out;
}
nnodeblk = nblocks - ndatablk;
while (ndatablk-- > 0) {