Re: [PATCH] nilfs2: validate file block counts during recovery

[Viacheslav Dubeyko]

On Tue, 2026-09-15 at 08:13 -0300, Aldo Ariel Panzardo wrote:
> nilfs_scan_dsync_log() trusts the block counts in each on-disk file
> information entry. If fi_ndatablk is greater than fi_nblocks, the
> data
> block loop can consume excessive summary entries and the later
> subtraction
> used to derive the number of node blocks underflows.
> 
> Reject inconsistent file information entries before consuming their
> block
> information.
> 
> Fixes: 0f3e1c7f23f8 ("nilfs2: recovery functions")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@xxxxxxxxx>
> ---
>  fs/nilfs2/recovery.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/fs/nilfs2/recovery.c b/fs/nilfs2/recovery.c
> index 4d5a6aa521..6e4e0cf4cc 100644
> --- a/fs/nilfs2/recovery.c
> +++ b/fs/nilfs2/recovery.c
> @@ -322,6 +322,7 @@ static void nilfs_skip_summary_info(struct
> the_nilfs *nilfs,
>   *
>   * Return: 0 on success, or one of the following negative error
> codes on
>   * failure:
> + * * %-EINVAL	- Invalid block counts in a file information entry.
>   * * %-EIO	- I/O error.
>   * * %-ENOMEM	- Insufficient memory available.
>   */
> @@ -359,6 +360,10 @@ static int nilfs_scan_dsync_log(struct the_nilfs
> *nilfs, sector_t start_blocknr,
>  		ino = le64_to_cpu(finfo->fi_ino);
>  		nblocks = le32_to_cpu(finfo->fi_nblocks);
>  		ndatablk = le32_to_cpu(finfo->fi_ndatablk);
> +		if (ndatablk > nblocks) {
> +			err = -EINVAL;

It sounds like -EIO because we have corrupted state of on-disk
metadata.

Thanks,
Slava.

> +			goto out;
> +		}
>  		nnodeblk = nblocks - ndatablk;
>  
>  		while (ndatablk-- > 0) {