From c298301279bd233363de3aca5a32c055bf2f3239 Mon Sep 17 00:00:00 2001 From: Aldo Ariel Panzardo Date: Tue, 15 Sep 2026 16:52:23 -0300 Subject: [PATCH] nilfs2: validate segment number in nilfs_sufile_get_suinfo() nilfs_sufile_get_suinfo() subtracts the caller-provided segment number from the total number of segments without first checking its range. If the requested number is greater than the total, the unsigned subtraction wraps and the function may process segment numbers outside the filesystem. Cache the total while holding the metadata semaphore and return no entries when the starting segment number is at or beyond the end. Fixes: 6c98cd4ecb0a ("nilfs2: segment usage file") Cc: stable+noautosel@kernel.org # Non-fatal bug fix; defer backport until a real issue is reported Signed-off-by: Aldo Ariel Panzardo Acked-by: Ryusuke Konishi Reviewed-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko --- fs/nilfs2/sufile.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c index 6918be6fce2e..fec5af70c6dd 100644 --- a/fs/nilfs2/sufile.c +++ b/fs/nilfs2/sufile.c @@ -870,10 +870,14 @@ ssize_t nilfs_sufile_get_suinfo(struct inode *sufile, __u64 segnum, void *buf, down_read(&NILFS_MDT(sufile)->mi_sem); + nsegs = nilfs_sufile_get_nsegments(sufile); + if (segnum >= nsegs) { + ret = 0; + goto out; + } + segusages_per_block = nilfs_sufile_segment_usages_per_block(sufile); - nsegs = min_t(unsigned long, - nilfs_sufile_get_nsegments(sufile) - segnum, - nsi); + nsegs = min_t(unsigned long, nsegs - segnum, nsi); for (i = 0; i < nsegs; i += n, segnum += n) { n = min_t(unsigned long, segusages_per_block -