From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 62E98247DE1 for ; Mon, 15 Jun 2026 03:16:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781493406; cv=none; b=kSPP5RaX8PEkYxtFNCkFwcfKl8zF4es/fz3lcngIIY95n1v6yj4wcY6UIMlPG3vg1FLaQrB63/PZGRwtuM7zJsTFoKeDSu1wzumvXA71o3yWkGrdnmbO8fZ5cblTNf+BoxuPMjTSThyqmQZwtqlupLJhTPvXOls6lh1xw7H1sJo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781493406; c=relaxed/simple; bh=H6Tj3vQ5w9Hy0kfaFv8MDTQnmbjhHZg7k/XSqT5DEj4=; h=Message-ID:Date:MIME-Version:Cc:Subject:To:References:From: In-Reply-To:Content-Type; b=th9IgW2Hr/UxTcOj7D2AM2IxWMQwoIwcbv1yt/fI6kgoWlU4UJ6LmBSYQnCm2WM/c7hSPKUp0YRLWUs15uA8BYM4Q2eChnzZUuHg2/0DOe/8egVluIp1DD6QwojbFKkeYoPlqx18mdT55B8i2YvFv19pWWdNX9p7EOKIMlYhLNg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=k81ZqCRo; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="k81ZqCRo" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 07F3D1F000E9; Mon, 15 Jun 2026 03:16:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781493405; bh=raNVzxlxf+6Am20y+qpqw6MoOelLs8xABCqoCLiKUQs=; h=Date:Cc:Subject:To:References:From:In-Reply-To; b=k81ZqCRo2LEmGR2RM9BXDSybYeiUXLc8/l6HhtcQsjpQwCF9Zs9ZetDwhzos6rtd7 4X7jLUxhEgcxO474INjc1pWZGMskqjG8cpFIQGguk2FVjTJoH/FSMgTflB1Sk3OtuE jYJL3sErYqp52zZeEch39ZnEzD/lUpOsHjT81UH+B5gcaqlDkmP+tSzfaux0/juf8E 9LMqd/mQPSLsVO95J0Pg2NkjNMWZeqcKP7YVRg43JPN2r59lrVkN8Umj+WYVOQZoge rytv/IR38nIYYLW3PgrOiDm/jmOCdP5By8QylyVHPCOdxWrTWP8lA9ehI+YCrjJgUR fM2tBnAE+yvIw== Message-ID: <069c7bab-42aa-4e0d-b113-5919ec346fb5@kernel.org> Date: Mon, 15 Jun 2026 11:16:41 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Cc: chao@kernel.org, "open list:F2FS FILE SYSTEM" , open list Subject: Re: [PATCH] f2fs: validate dentry name length before lookup compares it To: Samuel Moelius , Jaegeuk Kim References: <20260603161127.17464-1-sam.moelius@trailofbits.com> Content-Language: en-US From: Chao Yu In-Reply-To: <20260603161127.17464-1-sam.moelius@trailofbits.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 6/4/26 00:11, Samuel Moelius wrote: > The f2fs dentry lookup path can use the on-disk name length before > checking that the name fits in the dentry filename area. A corrupted > dentry can then make lookup read beyond the filename slots. > > The bounds check needs to happen before any comparison that consumes > the name length from disk. > > Reject dentries with invalid name lengths before comparing their names. Will be better to merge two patch into one: f2fs: validate inline dentry name lengths before conversion f2fs: validate dentry name length before lookup compares it > > Assisted-by: Codex:gpt-5.5-cyber-preview > Signed-off-by: Samuel Moelius Anyway, this patch looks good to me. Reviewed-by: Chao Yu Thanks,