In nilfs_direct_propagate(), the printer get from nilfs_direct_get_ptr()
need to be checked to ensure it is not an invalid pointer.

If the pointer value obtained by nilfs_direct_get_ptr() is
NILFS_BMAP_INVALID_PTR, means that the metadata (in this case,
i_bmap in the nilfs_inode_info struct) thatshould  point to the data
block at the buffer head of the argument is corrupted and the data
block is orphaned, meaning that the file system has lost consistency.

Add a value check and return -EINVAL when it is an invalid pointer.

Fixes: 36a580eb489f ("nilfs2: direct block mapping")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 fs/nilfs2/direct.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
index 893ab36824cc..2d8dc6b35b54 100644
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -273,6 +273,9 @@ static int nilfs_direct_propagate(struct nilfs_bmap *bmap,
 	dat = nilfs_bmap_get_dat(bmap);
 	key = nilfs_bmap_data_get_key(bmap, bh);
 	ptr = nilfs_direct_get_ptr(bmap, key);
+	if (ptr == NILFS_BMAP_INVALID_PTR)
+		return -EINVAL;
+
 	if (!buffer_nilfs_volatile(bh)) {
 		oldreq.pr_entry_nr = ptr;
 		newreq.pr_entry_nr = ptr;
-- 
2.42.0.windows.2

On Sat, Apr 5, 2025 at 6:57 PM Wentao Liang wrote:
>
> In nilfs_direct_propagate(), the printer get from nilfs_direct_get_ptr()
> need to be checked to ensure it is not an invalid pointer.
>
> If the pointer value obtained by nilfs_direct_get_ptr() is
> NILFS_BMAP_INVALID_PTR, means that the metadata (in this case,
> i_bmap in the nilfs_inode_info struct) thatshould  point to the data
> block at the buffer head of the argument is corrupted and the data
> block is orphaned, meaning that the file system has lost consistency.
>
> Add a value check and return -EINVAL when it is an invalid pointer.
>
> Fixes: 36a580eb489f ("nilfs2: direct block mapping")
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  fs/nilfs2/direct.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
> index 893ab36824cc..2d8dc6b35b54 100644
> --- a/fs/nilfs2/direct.c
> +++ b/fs/nilfs2/direct.c
> @@ -273,6 +273,9 @@ static int nilfs_direct_propagate(struct nilfs_bmap *bmap,
>         dat = nilfs_bmap_get_dat(bmap);
>         key = nilfs_bmap_data_get_key(bmap, bh);
>         ptr = nilfs_direct_get_ptr(bmap, key);
> +       if (ptr == NILFS_BMAP_INVALID_PTR)
> +               return -EINVAL;
> +
>         if (!buffer_nilfs_volatile(bh)) {
>                 oldreq.pr_entry_nr = ptr;
>                 newreq.pr_entry_nr = ptr;
> --
> 2.42.0.windows.2
>

Thanks for your help!

I'll handle this patch.

Ryusuke Konishi