Re: [PATCH] nilfs2: prevent out-of-bounds read in super root block parsing

On Sat, 2026-07-18 at 01:56 +0900, Ryusuke Konishi wrote:
> From: David Lee <[email protected]>
>=20
> super-root inode metadata size is trusted before
> nilfs_read_inode_common().
>=20
> Reject super-root inode sizes whose computed on-disk footprint
> exceeds the
> filesystem block size. This prevents malformed filesystem images from
> making nilfs_read_inode_common() read past the end of the super-root
> block.
>=20
> [ryusuke: clarify the commit title]
>=20
> Fixes: 8a9d2191e9f4 ("nilfs2: operations for the_nilfs core object")
> Signed-off-by: David Lee <[email protected]>
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Ryusuke Konishi <[email protected]>
> ---
> Hi Viacheslav,
>=20
> please apply this for the next cycle.
>=20
> As described, this prevents out-of-bounds memory access that could
> occur with a tampered file system image.
>=20
> Thanks,
> Ryusuke Konishi
>=20
> =C2=A0fs/nilfs2/the_nilfs.c | 6 ++++++
> =C2=A01 file changed, 6 insertions(+)
>=20
> diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
> index 7b23e373a106..f3805e7aabeb 100644
> --- a/fs/nilfs2/the_nilfs.c
> +++ b/fs/nilfs2/the_nilfs.c
> @@ -461,6 +461,12 @@ static int nilfs_store_disk_layout(struct
> the_nilfs *nilfs,
> =C2=A0			=C2=A0 nilfs->ns_inode_size);
> =C2=A0		return -EINVAL;
> =C2=A0	}
> +	if (NILFS_SR_BYTES(nilfs->ns_inode_size) > nilfs-
> >ns_blocksize) {
> +		nilfs_err(nilfs->ns_sb,
> +			=C2=A0 "too large inode size for super root: %d
> bytes",
> +			=C2=A0 nilfs->ns_inode_size);
> +		return -EINVAL;
> +	}
> =C2=A0
> =C2=A0	nilfs->ns_first_ino =3D le32_to_cpu(sbp->s_first_ino);
> =C2=A0	if (nilfs->ns_first_ino < NILFS_USER_INO) {

Applied.

Thanks,
Slava.