Re: [PATCH] f2fs: check every cur_*_segno[] entry on readonly images

[Chao Yu <chao@kernel.org>]

On 9/19/26 00:55, Kaixuan Li wrote:
> sanity_check_ckpt() bounds-checks cur_node_segno[] and cur_data_segno[]
> against main_segs, but on an image with the RO feature the goto that skips
> the duplicate-segno cross-checks also leaves the enclosing loop, so only
> index 0 of each array is ever checked.
> 
> An unchecked index reaches __set_sit_entry_type() through build_curseg() ->
> reset_curseg(), which writes se->type through &sit_i->sentries[segno]. With
> segment_count_main 120 and cur_data_segno[1] set to 200, KASAN reports
> three out-of-bounds writes during mount and the mount then succeeds.
> 
> Use continue so every index is bounds-checked, and skip the node-vs-data
> cross-check explicitly, which is the other thing the old goto skipped.
> 

Cc: stable@kernel.org

> Fixes: a7d9fe3c3388 ("f2fs: support RO feature")
> Signed-off-by: Kaixuan Li <kaixuanli0131@gmail.com>

Reviewed-by: Chao Yu <chao@kernel.org>

Thanks,