From: Chao Yu Date: Mon, 6 Dec 2021 14:44:21 +0000 (+0800) Subject: f2fs: fix to do sanity check in is_alive() X-Git-Tag: v5.10.95~563 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=08283b076f4e889df3e46849bcdf3d388c2d6257;p=platform%2Fkernel%2Flinux-rpi.git f2fs: fix to do sanity check in is_alive() commit 77900c45ee5cd5da63bd4d818a41dbdf367e81cd upstream. In fuzzed image, SSA table may indicate that a data block belongs to invalid node, which node ID is out-of-range (0, 1, 2 or max_nid), in order to avoid migrating inconsistent data in such corrupted image, let's do sanity check anyway before data block migration. Cc: stable@vger.kernel.org Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Greg Kroah-Hartman --- diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c index 72f227f6ebad..6b240b71d2e8 100644 --- a/fs/f2fs/gc.c +++ b/fs/f2fs/gc.c @@ -998,6 +998,9 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, set_sbi_flag(sbi, SBI_NEED_FSCK); } + if (f2fs_check_nid_range(sbi, dni->ino)) + return false; + *nofs = ofs_of_node(node_page); source_blkaddr = data_blkaddr(NULL, node_page, ofs_in_node); f2fs_put_page(node_page, 1);