Re: [PATCH] nilfs2: strengthen consistency checks in nilfs_direct_propagate()

[Viacheslav Dubeyko]

On Fri, 2026-09-04 at 02:23 +0900, Ryusuke Konishi wrote:
> nilfs_direct_propagate() is responsible for updating the virtual
> block
> number associated with a dirty data block in the direct mapping.
> 
> It is not designed to handle intermediate node blocks.  Furthermore,
> it
> assumes that the block offset of the passed buffer head is within the
> range of NILFS_DIRECT_KEY_MAX; otherwise, an out-of-bounds memory
> access
> could occur within the inode containing the bmap root.
> 
> While such inconsistencies stem from bugs, they can cause silent,
> harmful side effects unless a debug kernel is used - as was the case
> with a recent slab out-of-bounds access issue found in this function.
> 
> Therefore, issue a kernel warning via WARN_ON_ONCE() and return -
> EINVAL
> for these anomalies, allowing the bmap layer to handle the situation
> as
> a filesystem error.
> 
> Signed-off-by: Ryusuke Konishi <konishi.ryusuke@xxxxxxxxx>
> ---
> Hi Viacheslav,
> 
> Please queue this for the next cycle.
> 
> While the recent out-of-bounds memory access issue in
> nilfs_direct_propagate() has already been fixed, this adds extra
> checks
> to catch and gracefully handle similar potential bugs.
> 
> Thanks,
> Ryusuke Konishi
> 
>  fs/nilfs2/direct.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
> index b8643d3aa2f8..64da677dc8d4 100644
> --- a/fs/nilfs2/direct.c
> +++ b/fs/nilfs2/direct.c
> @@ -270,8 +270,14 @@ static int nilfs_direct_propagate(struct
> nilfs_bmap *bmap,
>  	if (!NILFS_BMAP_USE_VBN(bmap))
>  		return 0;
>  
> +	if (WARN_ON_ONCE(buffer_nilfs_node(bh)))
> +		return -EINVAL;
> +
>  	dat = nilfs_bmap_get_dat(bmap);
>  	key = nilfs_bmap_data_get_key(bmap, bh);
> +	if (WARN_ON_ONCE(key > NILFS_DIRECT_KEY_MAX))
> +		return -EINVAL;
> +
>  	ptr = nilfs_direct_get_ptr(bmap, key);
>  	if (ptr == NILFS_BMAP_INVALID_PTR)
>  		return -EINVAL;

Applied.

Thanks,
Slava.