From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3488B39A06B for ; Wed, 4 Mar 2026 12:25:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772627101; cv=none; b=MXFCgWuzt4pl8ZXn9evYR86vzNZ15TriEWdTU5VGik9Phdk6pgON8Lxcjcck8/KQdUI6HErmL5Hf+7LNBGx3mrEj4e2Z2q2zp7uPvhRRIikg357Gi0DsLHLblsZg6lBY+ucTkzzRSQ8GERtzTvMo2UurnHrmNYsO/MmKEabgtx4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772627101; c=relaxed/simple; bh=xY8w/SLBNyQ0i8Q5a3+WjokCNIdJBW4jppsDD/caqoA=; h=Message-ID:Date:MIME-Version:Cc:Subject:To:References:From: In-Reply-To:Content-Type; b=GPGKfS7GQilMxr0SPBeYhrHnnnZ+QPN4F2UPRkCpcG5RQwJxosfs0r0fY0csGerPVyHynRFq3mpRz84eRAmS9H4YWoXKrn/UhZVENuzPgHX/TaJ+7Sj6/uhj5mNRe73xqJ3TwGpt9EzWFHgDE8GCHRwO7yViU4f7v9u/8sFiy8E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=BQAjgt6b; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="BQAjgt6b" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0720C19423; Wed, 4 Mar 2026 12:24:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772627100; bh=xY8w/SLBNyQ0i8Q5a3+WjokCNIdJBW4jppsDD/caqoA=; h=Date:Cc:Subject:To:References:From:In-Reply-To:From; b=BQAjgt6bglXbxe3YQfrnj/4MpMnyfGx0N7Ig4ujPmb1xLx+AtwDrF+T8tqOafsSqX 3DNjvxuaCJ0L3lN8sTyKnphQUt4xlxdEUJBH5NGzRvBAz7vgwFZMNz/G0Df1/8H0Xj KWXlKbgmNjsKpRjqR3qkLj824c8j1Qk2INgrCZKZc4RjveFd82C3GF06yZ93gbHKQo dJ8HUbOkYf0FzY6/XpImz+UgNijtt1OS3p5iZHp0XyF3cgKYzzXZin2ChzUcD3MNEa M6ZZU7HMO9WlxIWJLyjAHU9Fe/WDZm+t2pU66AvEddoKYTuuIFUhq2RYTm2D5Kmh9v byNhs/pldiZqw== Message-ID: <46c69e75-f797-4121-b740-afa1096132cd@kernel.org> Date: Wed, 4 Mar 2026 20:24:55 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Cc: chao@kernel.org, Daeho Jeong , Maxim Pleshivenkov Subject: Re: [f2fs-dev] [PATCH] f2fs-tools: fix heap-buffer-overflow of reading SSA from checkpoint area To: Daeho Jeong , linux-kernel@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net, kernel-team@android.com References: <20260303170036.2242819-1-daeho43@gmail.com> Content-Language: en-US From: Chao Yu In-Reply-To: <20260303170036.2242819-1-daeho43@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 2026/3/4 01:00, Daeho Jeong wrote: > From: Daeho Jeong > > Reproduction: > truncate -s 512M overflow.img > ./out/host/linux-x86/bin/make_f2fs -g android -b 16384 -w 16384 -O packed_ssa overflow.img > mkdir -p empty_dir > export ASAN_OPTIONS=detect_leaks=0:abort_on_error=1 > ./out/host/linux-x86/bin/sload_f2fs -f empty_dir -t /data overflow.img > > Result: > ==306082==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7df5201e2500 at pc 0x5567ea010583 bp 0x7ffc3386c210 sp 0x7ffc3386b9d8 > READ of size 16384 at 0x7df5201e2500 thread T0 > > Even though we can reduce the summary block to 4KB, we need to maintain > backward compatibility for the checkpoint area. Therefore, the summary > block there must match the block size, so it is correct to use F2FS_BLKSIZE. > > Fixes: ad1357c34023 ("f2fs-tools: revert summary entry count from 2048 to 512 in 16kb block support") > Reported-by: Maxim Pleshivenkov > Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Thanks,