From: Daeho Jeong <daehojeong@google.com>

If an invalid segment type (type < 0 || type >= NO_CHECK_TYPE) is read
from SIT during block update, update_block() now validates the type,
reports corruption, and falls back to a valid active curseg type when
fix_on is enabled. find_next_free_block() also validates want_type to
prevent out-of-bounds accesses.

Signed-off-by: Daeho Jeong <daehojeong@google.com>
---
 fsck/mount.c   |  5 +++++
 fsck/segment.c | 14 ++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/fsck/mount.c b/fsck/mount.c
index 85ed404..ce96a44 100644
--- a/fsck/mount.c
+++ b/fsck/mount.c
@@ -3059,6 +3059,11 @@ int find_next_free_block(struct f2fs_sb_info *sbi, u64 *to, int left,
 	u64 end_blkaddr = (get_sb(segment_count_main) <<
 			get_sb(log_blocks_per_seg)) + get_sb(main_blkaddr);
 
+	if (want_type < 0 || want_type >= NO_CHECK_TYPE) {
+		ERR_MSG("Invalid segment type %d for block allocation\n", want_type);
+		return -EINVAL;
+	}
+
 	if (c.zoned_model == F2FS_ZONED_HM && !new_sec) {
 		struct curseg_info *curseg = CURSEG_I(sbi, want_type);
 		unsigned int segs_per_zone = sbi->segs_per_sec * sbi->secs_per_zone;
diff --git a/fsck/segment.c b/fsck/segment.c
index 46dc747..1ae90bf 100644
--- a/fsck/segment.c
+++ b/fsck/segment.c
@@ -779,6 +779,20 @@ int update_block(struct f2fs_sb_info *sbi, void *buf, u32 *blkaddr,
 	se = get_seg_entry(sbi, GET_SEGNO(sbi, old_blkaddr));
 	offset = OFFSET_IN_SEG(sbi, old_blkaddr);
 	type = se->type;
+	if (type < 0 || type >= NO_CHECK_TYPE) {
+		MSG(0, "[FSCK] Invalid SIT segment type %d at blkaddr 0x%"PRIx64"\n",
+				type, old_blkaddr);
+		c.bug_on = 1;
+
+		if (!c.fix_on)
+			return -EINVAL;
+
+		int fixed_type = IS_NODESEG(type) ? CURSEG_HOT_NODE : CURSEG_HOT_DATA;
+
+		FIX_MSG("Correct invalid segment type %d -> %d for blkaddr 0x%"PRIx64"\n",
+				type, fixed_type, old_blkaddr);
+		type = fixed_type;
+	}
 	se->valid_blocks--;
 	f2fs_clear_bit(offset, (char *)se->cur_valid_map);
 	if (need_fsync_data_record(sbi))
-- 
2.55.0.229.g6434b31f56-goog