From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f174.google.com (mail-qk1-f174.google.com [209.85.222.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 79EA130568E for ; Fri, 17 Jul 2026 10:38:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784284716; cv=none; b=WktQyA0dwsmDyJA0zgQcmIH16sebAgqJiDMhqhZvN8sznTIPLjj5wDBZqSw5Uo4cFhXYQ85fzV/ng+c55B5tz1kOnBYNZ2tw4bRmPy5yIm973tDW2jpVqX0fmg5sYXNgoC1b8ueRsBB2EQRs251SCsi7uysg7OemdYi2YfjjgeI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784284716; c=relaxed/simple; bh=u5M9wdtQ4nbu8mWPmfgLxQD5GRtN9bWbigfsKbcKOzM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=kU8jmxXhjmUhUXFt6thfcDt4Vm5oC12cU4Cw7Ei/v/OWDiIUDUhmUGBkqhqVwvziJK6DSNSl+jVFrrkopgij30lAvxwYIEGBAsLh+iZDZPK00Pb7hOKhzdS/wOxlZrtUpXUccmQRN4v2Uwgx5U1kcT28qL0+tY2Ofw4aP1qn3r0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=WtRF3xmo; arc=none smtp.client-ip=209.85.222.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="WtRF3xmo" Received: by mail-qk1-f174.google.com with SMTP id af79cd13be357-92e4fd65b2bso336760085a.0 for ; Fri, 17 Jul 2026 03:38:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1784284714; x=1784889514; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=VVQ5U1p0pPiqFfCwN3xL6jXBxqNVEEeNn+I745UCOQ8=; b=WtRF3xmoWO/5MuTLRK5nl8s9kMYfkxkm7B2JiAM1aqdJVRSX/5+MnoFQQGe6L0mBb7 4rayrpMHDJxr7AyZnmfrvMENbe+uVoot+tqs+ITMW+0Ova1dEz2Ir51MGofbHgmnesg1 HT+YlUDPzv3UfUimKksDYhfNOcxkqE/fYaLjLzd8QYuNo6zAAEZp9LsJ5HCkHc3zzK48 RkhT9d2SyusGUlQZMyzFz7raXVJjGpd7R/BQPGy4Nom2dGV2oGh2Yd8mg4NWgO2dRJyr Zu4CYZtuFM/SpjG8oiNhvF+N4pjOBr1a88CYRc0v4u1iKdFVSjQqe0xcGzs7Suhi1U96 KYnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784284714; x=1784889514; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=VVQ5U1p0pPiqFfCwN3xL6jXBxqNVEEeNn+I745UCOQ8=; b=spX+NGPIS/GJKVezDBFuhwB+Hz598NFCyhctzcbhpGRsTJxkbIgHKNIi0nMpR/2e9s ouwbSHrpnnrG+3VqvO+MNQX50Y9HLZB6y2g4Ym1TNMhdM14P91icLliA5YGDCoEVQ83y vnDd2pB6SnX3EUBOnhQxUDnhNncXCgscx23Xann0KSuyoFSBxeHYKJtsXpH+cm6eT8/Z e4x7CUY7Gx/PSgdlY6RVPFUdNITrJnUXShzSYONrUtY5NSNyQPzWoNtqZHWd78sFP/wA IxLZXI0vz3k/5Sej6+LKFYVT74IP4GrKwSa80tlAnYoYAFGYXF3rxX7RsLRMp0Cgy85j JQdQ== X-Forwarded-Encrypted: i=1; AHgh+RoS4HHW23+QH85HY3qiYALtF3uUlKzjxSPA+cj59Cx/q04/TnZVpkrq0bjzIcvG6Bk9cAQYTCB3xzbn8iA=@vger.kernel.org X-Gm-Message-State: AOJu0Yx53ZthGiovo/FEbwafDy/hBfML8FASIolhSpkpyFJg0IQsdZ+R C7YOd1dwGTTXFKzn3WM88P8s6UmzoJXSYNLAr7k6HUV/GrTkDa2idriUfOMHz7dVwqI= X-Gm-Gg: AfdE7cltzMNiISMN9eX4Z05esWVApYvbmzqIZqJhtoHMMYT5pZ6GQbbUjTSV3ARq6Lt yRb/ThkbQH9mAvvy+Bc4pyjeR02fMjAuMm8UKQzgydQUXcuRWEhgNnXm+IAvcz8K8yecYiAt+JM OnOA71NxpYDi8prt4zB19+U9KshVW84j7Pw/obFWuCHkWoEjSoNmcuS62oAqjkwB0ssjyXZMfGb 2eNXEdo3heZP+kxQxXE/45kCfSJP1n20TC7rIEn3pjyGx9LrtyEst6Z9ESWaVx/X0OKXNUjC1ii 5xkd9cUuY5f3dY8d4i3npgW//A0xN2uH2JI42nNMmmxFwKWP0970LncTlQd9FocjJDGWZA+McOZ EcHIY8jHzZ2IXnhkX1kMxKnYQx9bRiWfBtijH3RA/ISuP6uf7qC3HQpfyYYiMpL93mrTO8cCkgo Ze2SrS4GA= X-Received: by 2002:a05:620a:708a:b0:92e:5f50:74fb with SMTP id af79cd13be357-930b3ed687emr186120285a.13.1784284714253; Fri, 17 Jul 2026 03:38:34 -0700 (PDT) Received: from localhost ([146.190.222.192]) by smtp.gmail.com with UTF8SMTPSA id af79cd13be357-930b52fa8dfsm122589285a.11.2026.07.17.03.38.33 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 17 Jul 2026 03:38:34 -0700 (PDT) From: David Lee To: Ryusuke Konishi Cc: David Lee , Viacheslav Dubeyko , linux-nilfs@vger.kernel.org, Dominik 'Disconnect3d' Czarnota , linux-kernel@vger.kernel.org Subject: [PATCH] NILFS2 superroot inode-size OOB read Date: Fri, 17 Jul 2026 10:38:30 +0000 Message-ID: <20260717103831.38492-1-david.lee@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit super-root inode metadata size is trusted before nilfs_read_inode_common(). Reject super-root inode sizes whose computed on-disk footprint exceeds the filesystem block size. This prevents malformed filesystem images from making nilfs_read_inode_common() read past the end of the super-root block. Fixes: 8a9d2191e9f4 ("nilfs2: operations for the_nilfs core object") Signed-off-by: David Lee Assisted-by: Codex:gpt-5.5 --- Trail of Bits has a reproducer that triggers kernel panic demonstrating this bug and can be shared if needed. fs/nilfs2/the_nilfs.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c index 7b23e373a106..f3805e7aabeb 100644 --- a/fs/nilfs2/the_nilfs.c +++ b/fs/nilfs2/the_nilfs.c @@ -461,6 +461,12 @@ static int nilfs_store_disk_layout(struct the_nilfs *nilfs, nilfs->ns_inode_size); return -EINVAL; } + if (NILFS_SR_BYTES(nilfs->ns_inode_size) > nilfs->ns_blocksize) { + nilfs_err(nilfs->ns_sb, + "too large inode size for super root: %d bytes", + nilfs->ns_inode_size); + return -EINVAL; + } nilfs->ns_first_ino = le32_to_cpu(sbp->s_first_ino); if (nilfs->ns_first_ino < NILFS_USER_INO) {