]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
nilfs2: add pointer check for nilfs_direct_propagate()
authorWentao Liang <vulab@iscas.ac.cn>
Mon, 28 Apr 2025 17:37:07 +0000 (02:37 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 27 Jun 2025 10:04:04 +0000 (11:04 +0100)
[ Upstream commit f43f02429295486059605997bc43803527d69791 ]

Patch series "nilfs2: improve sanity checks in dirty state propagation".

This fixes one missed check for block mapping anomalies and one improper
return of an error code during a preparation step for log writing, thereby
improving checking for filesystem corruption on writeback.

This patch (of 2):

In nilfs_direct_propagate(), the printer get from nilfs_direct_get_ptr()
need to be checked to ensure it is not an invalid pointer.

If the pointer value obtained by nilfs_direct_get_ptr() is
NILFS_BMAP_INVALID_PTR, means that the metadata (in this case, i_bmap in
the nilfs_inode_info struct) that should point to the data block at the
buffer head of the argument is corrupted and the data block is orphaned,
meaning that the file system has lost consistency.

Add a value check and return -EINVAL when it is an invalid pointer.

Link: https://lkml.kernel.org/r/20250428173808.6452-1-konishi.ryusuke@gmail.com
Link: https://lkml.kernel.org/r/20250428173808.6452-2-konishi.ryusuke@gmail.com
Fixes: 36a580eb489f ("nilfs2: direct block mapping")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/nilfs2/direct.c

index 7faf8c285d6c961141390d746e84ff54defc355d..a72371cd6b9560f4b71dbb24e1a209dbfd06f935 100644 (file)
@@ -273,6 +273,9 @@ static int nilfs_direct_propagate(struct nilfs_bmap *bmap,
        dat = nilfs_bmap_get_dat(bmap);
        key = nilfs_bmap_data_get_key(bmap, bh);
        ptr = nilfs_direct_get_ptr(bmap, key);
+       if (ptr == NILFS_BMAP_INVALID_PTR)
+               return -EINVAL;
+
        if (!buffer_nilfs_volatile(bh)) {
                oldreq.pr_entry_nr = ptr;
                newreq.pr_entry_nr = ptr;