From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D185E21B9F6 for ; Tue, 16 Jun 2026 02:57:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781578676; cv=none; b=B8WIPSjIYZf9bDVjydr5Ty+amao3YMUd8sheewQ8lK1Y0NbCnrT4dlNehrk51zZ3/bW+tqRSurB4/J97AJ/s1g0ZGukSkgA6sSNWCz+9YogCdLkY/cYAGUhyKtRU8Sapa4vEmHk5xYa8Gv42zNmuyPecYxGat+jwJ56kJq1qdKY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781578676; c=relaxed/simple; bh=uxAhjdGGNvJ8hEneOkmefPfdTtKonrec5OJMddAqMTE=; h=Message-ID:Date:MIME-Version:Cc:Subject:To:References:From: In-Reply-To:Content-Type; b=piRnm95VFshS8K/FFRChD+MtzHGneimIItMMVHWiVh1SrhxUuh838NY6BMcbomhL+Xt8KF3iiY2RlpMlOQH72MwfN+FY1KQqvBwkjsIHvm2dnylIZ+/+I4n3amS7Gm+Nzk+67sQGPQBanznA/zJRNo62Oys2+AVUtVgKKyOtQJw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RMAPy1Zd; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RMAPy1Zd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A1F1D1F00A3F; Tue, 16 Jun 2026 02:57:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781578675; bh=Vl3O63GUD8JadTXpBNvqiNKvx8/w5mkGJGi0G0VzTA0=; h=Date:Cc:Subject:To:References:From:In-Reply-To; b=RMAPy1Zd5FvsVTAkG/gUeGBDASHVe+XTLDHBzyRu2s7J/swSXn1CJl8h1Bv+JfXTM NLpmwinqd9fa/zauo1LkVwKB+oWcvQGAq3T/WERiUCOsB9j2iQQYg40XkMKILyBfDn fJNVzALi5Yj/CMKeAgWfT/okHKwwAshtx3j6+u2DUwx14kiXM+p9TOyv00gXeG54uo UzulhVXBAVrE7IMEcqS86X58JCV5GbxD4og8hm2maTFMadIO37IDNiclVAPUlAxHX9 BQIrePRYs1d19n58yg9D3mF5p+VHOwNRvl5WiqYOoe0R5/ZeyEF9un2gOQjEHNu1EJ XY821svi1P8hw== Message-ID: <11147e4f-74c3-4eef-8060-195267f7f390@kernel.org> Date: Tue, 16 Jun 2026 10:57:52 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Cc: chao@kernel.org, Samuel Moelius , "open list:F2FS FILE SYSTEM" , open list Subject: Re: [PATCH] f2fs: validate inline dentry name lengths before conversion To: Jaegeuk Kim References: <20260603154933.16368-1-sam.moelius@trailofbits.com> Content-Language: en-US From: Chao Yu In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 6/15/26 23:24, Jaegeuk Kim wrote: > On 06/15, Chao Yu wrote: >> On 6/3/26 23:49, Samuel Moelius wrote: >>> Inline dentry conversion copies names out of the inline dentry area >>> before checking that each recorded name length fits in the available >>> filename slots. >>> >>> A corrupted image can therefore make the conversion path read past >>> the inline filename storage while building the regular dentry block. >>> >>> Validate each inline dentry name length against the inline filename >>> area before copying it. >>> >>> Assisted-by: Codex:gpt-5.5-cyber-preview >>> Signed-off-by: Samuel Moelius >>> --- >>> fs/f2fs/inline.c | 4 ++++ >>> 1 file changed, 4 insertions(+) >>> >>> diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c >>> index 7aabfc9b43cb..4584dfbe3fb8 100644 >>> --- a/fs/f2fs/inline.c >>> +++ b/fs/f2fs/inline.c >>> @@ -507,6 +507,10 @@ static int f2fs_add_inline_entries(struct inode *dir, void *inline_dentry) >>> bit_pos++; >>> continue; >>> } >>> + if (unlikely(le16_to_cpu(de->name_len) > F2FS_NAME_LEN || >>> + bit_pos + GET_DENTRY_SLOTS(le16_to_cpu(de->name_len)) > >>> + d.max)) >>> + return -EFSCORRUPTED; >> >> err = -EFSCORRUPTED; >> goto punch_dentry_pages; > > Applied with it. Reviewed-by: Chao Yu Thanks, > >> >> Thanks, >> >>> >>> /* >>> * We only need the disk_name and hash to move the dentry. >>