Re: [PATCH] NILFS2 superroot inode-size OOB read

On Fri, Jul 17, 2026 at 7:38=E2=80=AFPM David Lee  wrote:
>
> super-root inode metadata size is trusted before nilfs_read_inode_common(=
).
>
> Reject super-root inode sizes whose computed on-disk footprint exceeds th=
e
> filesystem block size. This prevents malformed filesystem images from
> making nilfs_read_inode_common() read past the end of the super-root bloc=
k.
>
> Fixes: 8a9d2191e9f4 ("nilfs2: operations for the_nilfs core object")
> Signed-off-by: David Lee <[email protected]>
> Assisted-by: Codex:gpt-5.5
> ---
> Trail of Bits has a reproducer that triggers kernel panic demonstrating t=
his bug and can be shared if needed.
>

Thanks for the patch, David Lee.

This patch is certainly necessary, and the checking method and
location are appropriate.

However, regarding the patch title, I would like to modify it to
something like "nilfs2: fix potential super root inode-size OOB read"
to clarify its purpose.

I can make this change when submitting it upstream, or you are welcome
to resubmit it yourself.

Thanks,
Ryusuke Konishi

> fs/nilfs2/the_nilfs.c |    6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
> index 7b23e373a106..f3805e7aabeb 100644
> --- a/fs/nilfs2/the_nilfs.c
> +++ b/fs/nilfs2/the_nilfs.c
> @@ -461,6 +461,12 @@ static int nilfs_store_disk_layout(struct the_nilfs =
*nilfs,
>                           nilfs->ns_inode_size);
>                 return -EINVAL;
>         }
> +       if (NILFS_SR_BYTES(nilfs->ns_inode_size) > nilfs->ns_blocksize) {
> +               nilfs_err(nilfs->ns_sb,
> +                         "too large inode size for super root: %d bytes"=
,
> +                         nilfs->ns_inode_size);
> +               return -EINVAL;
> +       }
>
>         nilfs->ns_first_ino =3D le32_to_cpu(sbp->s_first_ino);
>         if (nilfs->ns_first_ino < NILFS_USER_INO) {