Re: [PATCH] f2fs: bound the SIT/NAT bitmaps by the checkpoint pack

[Chao Yu <chao@kernel.org>]

On 9/19/26 21:09, Kaixuan Li wrote:
> sit_ver_bitmap_bytesize and nat_ver_bitmap_bytesize are used as memcpy
> lengths into and out of sbi->ckpt, which is sized from cp_payload alone,
> and nothing compares either length against that allocation.
> 
> sanity_check_ckpt() has checked these two fields since c77ec61ca0a4, which
> added them after a crafted image overran build_sit_info(). That check ties
> each length to a segment count; it never compares either against the
> allocation, which is the half this adds.
> 
> Mounting over-reads in build_sit_info() and build_node_manager(), and the
> first checkpoint writes the same lengths back through the same pointers,
> so the over-read's contents reach the on-disk checkpoint. An unmount is
> enough; the filesystem does not have to be used.
> 
> Bound both ends the way __bitmap_ptr() lays them out. The three branches
> differ, so a single sum of the two lengths would still admit a small
> overflow when cp_payload is non-zero.
> 

Cc: stable@kernel.org

> Fixes: c77ec61ca0a4 ("f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize")

The overflow issue exists before this commit?

Thanks,