Re: [PATCH] f2fs: validate MOVE_RANGE destination size

[Wenjie Qi]

ping

On Tue, Jun 30, 2026 at 11:17 AM Wenjie Qi <qwjhust@xxxxxxxxx> wrote:
>
> F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end
> before updating i_size. A source hole can expose this: __clone_blkaddrs()
> skips NULL_ADDR entries and returns success, so the caller can still extend
> the destination inode with unchecked pos_out + len.
>
> Reject destination overflow and use inode_newsize_ok() before extending
> the destination inode.
>
> Fixes: 4dd6f977fc77 ("f2fs: support an ioctl to move a range of data blocks")
> Cc: stable@xxxxxxxxxx
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Wenjie Qi <qiwenjie@xxxxxxxxxx>
> ---
>  fs/f2fs/file.c | 16 ++++++++++++----
>  1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
> index 4b52c56d71f0..2a5c6f741f56 100644
> --- a/fs/f2fs/file.c
> +++ b/fs/f2fs/file.c
> @@ -3121,8 +3121,9 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
>         struct inode *dst = file_inode(file_out);
>         struct f2fs_sb_info *sbi = F2FS_I_SB(src);
>         struct f2fs_lock_context lc;
> -       size_t olen = len, dst_max_i_size = 0;
> -       size_t dst_osize;
> +       size_t olen = len;
> +       loff_t dst_max_i_size = 0;
> +       loff_t dst_osize, dst_end;
>         int ret;
>
>         if (file_in->f_path.mnt != file_out->f_path.mnt ||
> @@ -3179,8 +3180,15 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
>         }
>
>         dst_osize = dst->i_size;
> -       if (pos_out + olen > dst->i_size)
> -               dst_max_i_size = pos_out + olen;
> +       if (olen > LLONG_MAX - pos_out)
> +               goto out_unlock;
> +       dst_end = pos_out + olen;
> +       if (dst_end > dst->i_size) {
> +               ret = inode_newsize_ok(dst, dst_end);
> +               if (ret)
> +                       goto out_unlock;
> +               dst_max_i_size = dst_end;
> +       }
>
>         /* verify the end result is block aligned */
>         if (!IS_ALIGNED(pos_in, F2FS_BLKSIZE) ||
> --
> 2.43.0
>