Re: [f2fs-dev] [PATCH] f2fs: validate inline dentry name lengths before conversion

Chao Yu via Linux-f2fs-devel <[email protected]> Mon, 15 Jun 2026 11:14:04 +0800

Newsgroups	net.sourceforge.lists.linux-f2fs-devel,org.kernel.vger.linux-kernel
Message-ID	<[email protected]>

On 6/3/26 23:49, Samuel Moelius wrote:
> Inline dentry conversion copies names out of the inline dentry area
> before checking that each recorded name length fits in the available
> filename slots.
> 
> A corrupted image can therefore make the conversion path read past
> the inline filename storage while building the regular dentry block.
> 
> Validate each inline dentry name length against the inline filename
> area before copying it.
> 
> Assisted-by: Codex:gpt-5.5-cyber-preview
> Signed-off-by: Samuel Moelius <[email protected]>
> ---
>  fs/f2fs/inline.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
> index 7aabfc9b43cb..4584dfbe3fb8 100644
> --- a/fs/f2fs/inline.c
> +++ b/fs/f2fs/inline.c
> @@ -507,6 +507,10 @@ static int f2fs_add_inline_entries(struct inode *dir, void *inline_dentry)
>  			bit_pos++;
>  			continue;
>  		}
> +		if (unlikely(le16_to_cpu(de->name_len) > F2FS_NAME_LEN ||
> +			     bit_pos + GET_DENTRY_SLOTS(le16_to_cpu(de->name_len)) >
> +			     d.max))
> +			return -EFSCORRUPTED;

	err = -EFSCORRUPTED;
	goto punch_dentry_pages;

Thanks,

>  
>  		/*
>  		 * We only need the disk_name and hash to move the dentry.



_______________________________________________
Linux-f2fs-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel