]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
f2fs: validate dentry name length before lookup compares it
authorSamuel Moelius <sam.moelius@trailofbits.com>
Wed, 3 Jun 2026 16:11:26 +0000 (16:11 +0000)
committerJaegeuk Kim <jaegeuk@kernel.org>
Mon, 22 Jun 2026 19:52:37 +0000 (19:52 +0000)
commit90e02a8e1b6863c41876473f844c8e24b06d55f7
treeae48360e6b25f68e1c164380cb6e5585ecae7982
parentcfcd0e49a178b3dac2c0ece656079081dbf5da74
f2fs: validate dentry name length before lookup compares it

The f2fs dentry lookup path can use the on-disk name length before
checking that the name fits in the dentry filename area.  A corrupted
dentry can then make lookup read beyond the filename slots.

The bounds check needs to happen before any comparison that consumes
the name length from disk.

Reject dentries with invalid name lengths before comparing their names.

Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
fs/f2fs/dir.c