Re: [f2fs-dev] [PATCH] fsck.f2fs: sanitize invalid segment type during block update

[Chao Yu <chao@kernel.org>]

On 7/24/26 04:02, Daeho Jeong wrote:
> From: Daeho Jeong <daehojeong@google.com>
> 
> If an invalid segment type (type < 0 || type >= NO_CHECK_TYPE) is read
> from SIT during block update, update_block() now validates the type,
> reports corruption, and falls back to a valid active curseg type when
> fix_on is enabled. find_next_free_block() also validates want_type to
> prevent out-of-bounds accesses.
> 
> Signed-off-by: Daeho Jeong <daehojeong@google.com>
> ---
>   fsck/mount.c   |  5 +++++
>   fsck/segment.c | 14 ++++++++++++++
>   2 files changed, 19 insertions(+)
> 
> diff --git a/fsck/mount.c b/fsck/mount.c
> index 85ed404..ce96a44 100644
> --- a/fsck/mount.c
> +++ b/fsck/mount.c
> @@ -3059,6 +3059,11 @@ int find_next_free_block(struct f2fs_sb_info *sbi, u64 *to, int left,
>   	u64 end_blkaddr = (get_sb(segment_count_main) <<
>   			get_sb(log_blocks_per_seg)) + get_sb(main_blkaddr);
>   
> +	if (want_type < 0 || want_type >= NO_CHECK_TYPE) {
> +		ERR_MSG("Invalid segment type %d for block allocation\n", want_type);

Use ASSERT_MSG() instead? it can set c.bug_on.

> +		return -EINVAL;
> +	}
> +
>   	if (c.zoned_model == F2FS_ZONED_HM && !new_sec) {
>   		struct curseg_info *curseg = CURSEG_I(sbi, want_type);
>   		unsigned int segs_per_zone = sbi->segs_per_sec * sbi->secs_per_zone;
> diff --git a/fsck/segment.c b/fsck/segment.c
> index 46dc747..1ae90bf 100644
> --- a/fsck/segment.c
> +++ b/fsck/segment.c
> @@ -779,6 +779,20 @@ int update_block(struct f2fs_sb_info *sbi, void *buf, u32 *blkaddr,
>   	se = get_seg_entry(sbi, GET_SEGNO(sbi, old_blkaddr));
>   	offset = OFFSET_IN_SEG(sbi, old_blkaddr);
>   	type = se->type;
> +	if (type < 0 || type >= NO_CHECK_TYPE) {
> +		MSG(0, "[FSCK] Invalid SIT segment type %d at blkaddr 0x%"PRIx64"\n",
> +				type, old_blkaddr);
> +		c.bug_on = 1;

Ditto,

> +
> +		if (!c.fix_on)
> +			return -EINVAL;
> +
> +		int fixed_type = IS_NODESEG(type) ? CURSEG_HOT_NODE : CURSEG_HOT_DATA;
> +
> +		FIX_MSG("Correct invalid segment type %d -> %d for blkaddr 0x%"PRIx64"\n",
> +				type, fixed_type, old_blkaddr);
> +		type = fixed_type;

How about fixing se->type directly, otherwise we may fix this in local stack
repeatly whenever encounter this buggy se->type.

Please refer to fix_section_type().

Thanks,

> +	}
>   	se->valid_blocks--;
>   	f2fs_clear_bit(offset, (char *)se->cur_valid_map);
>   	if (need_fsync_data_record(sbi))