From 9c4ee79190c8c23a9fb5c07d3bc87eaac514b2bb Mon Sep 17 00:00:00 2001 From: Kaixuan Li Date: Sat, 19 Sep 2026 00:55:07 +0800 Subject: f2fs: check every cur_*_segno[] entry on readonly images sanity_check_ckpt() bounds-checks cur_node_segno[] and cur_data_segno[] against main_segs, but on an image with the RO feature the goto that skips the duplicate-segno cross-checks also leaves the enclosing loop, so only index 0 of each array is ever checked. An unchecked index reaches __set_sit_entry_type() through build_curseg() -> reset_curseg(), which writes se->type through &sit_i->sentries[segno]. With segment_count_main 120 and cur_data_segno[1] set to 200, KASAN reports three out-of-bounds writes during mount and the mount then succeeds. Use continue so every index is bounds-checked, and skip the node-vs-data cross-check explicitly, which is the other thing the old goto skipped. Cc: stable@kernel.org Fixes: a7d9fe3c3388 ("f2fs: support RO feature") Signed-off-by: Kaixuan Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim --- fs/f2fs/super.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 2b9213db2c0f..17aae65e750e 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -4336,7 +4336,7 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi) return 1; if (f2fs_sb_has_readonly(sbi)) - goto check_data; + continue; for (j = i + 1; j < NR_CURSEG_NODE_TYPE; j++) { if (le32_to_cpu(ckpt->cur_node_segno[i]) == @@ -4348,14 +4348,14 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi) } } } -check_data: + for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) { if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs || le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg) return 1; if (f2fs_sb_has_readonly(sbi)) - goto skip_cross; + continue; for (j = i + 1; j < NR_CURSEG_DATA_TYPE; j++) { if (le32_to_cpu(ckpt->cur_data_segno[i]) == @@ -4367,6 +4367,9 @@ check_data: } } } + if (f2fs_sb_has_readonly(sbi)) + goto skip_cross; + for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) { for (j = 0; j < NR_CURSEG_DATA_TYPE; j++) { if (le32_to_cpu(ckpt->cur_node_segno[i]) == -- cgit v1.2.3