From 8393ce53a5497552320a34794549c18503dd491b Mon Sep 17 00:00:00 2001 From: Aldo Ariel Panzardo Date: Tue, 15 Sep 2026 08:13:51 -0300 Subject: [PATCH] nilfs2: validate file block counts during recovery nilfs_scan_dsync_log() trusts the block counts in each on-disk file information entry. If fi_ndatablk is greater than fi_nblocks, the data block loop can consume excessive summary entries and the later subtraction used to derive the number of node blocks underflows. Reject inconsistent file information entries before consuming their block information. Fixes: 0f3e1c7f23f8 ("nilfs2: recovery functions") Cc: stable+noautosel@kernel.org # Non-fatal bug fix; defer backport until a real issue is reported Signed-off-by: Aldo Ariel Panzardo Acked-by: Ryusuke Konishi Signed-off-by: Viacheslav Dubeyko --- fs/nilfs2/recovery.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c index 45fb37215669..9a70c28ec94c 100644 --- a/fs/nilfs2/recovery.c +++ b/fs/nilfs2/recovery.c @@ -322,6 +322,7 @@ static void nilfs_skip_summary_info(struct the_nilfs *nilfs, * * Return: 0 on success, or one of the following negative error codes on * failure: + * * %-EINVAL - Invalid block counts in a file information entry. * * %-EIO - I/O error. * * %-ENOMEM - Insufficient memory available. */ @@ -359,6 +360,10 @@ static int nilfs_scan_dsync_log(struct the_nilfs *nilfs, sector_t start_blocknr, ino = le64_to_cpu(finfo->fi_ino); nblocks = le32_to_cpu(finfo->fi_nblocks); ndatablk = le32_to_cpu(finfo->fi_ndatablk); + if (ndatablk > nblocks) { + err = -EINVAL; + goto out; + } nnodeblk = nblocks - ndatablk; while (ndatablk-- > 0) {