nilfs_direct_propagate() is responsible for updating the virtual block
number associated with a dirty data block in the direct mapping.

It is not designed to handle intermediate node blocks.  Furthermore, it
assumes that the block offset of the passed buffer head is within the
range of NILFS_DIRECT_KEY_MAX; otherwise, an out-of-bounds memory access
could occur within the inode containing the bmap root.

While such inconsistencies stem from bugs, they can cause silent,
harmful side effects unless a debug kernel is used - as was the case
with a recent slab out-of-bounds access issue found in this function.

Therefore, issue a kernel warning via WARN_ON_ONCE() and return -EINVAL
for these anomalies, allowing the bmap layer to handle the situation as
a filesystem error.

Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
---
Hi Viacheslav,

Please queue this for the next cycle.

While the recent out-of-bounds memory access issue in
nilfs_direct_propagate() has already been fixed, this adds extra checks
to catch and gracefully handle similar potential bugs.

Thanks,
Ryusuke Konishi

 fs/nilfs2/direct.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
index b8643d3aa2f8..64da677dc8d4 100644
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -270,8 +270,14 @@ static int nilfs_direct_propagate(struct nilfs_bmap *bmap,
 	if (!NILFS_BMAP_USE_VBN(bmap))
 		return 0;
 
+	if (WARN_ON_ONCE(buffer_nilfs_node(bh)))
+		return -EINVAL;
+
 	dat = nilfs_bmap_get_dat(bmap);
 	key = nilfs_bmap_data_get_key(bmap, bh);
+	if (WARN_ON_ONCE(key > NILFS_DIRECT_KEY_MAX))
+		return -EINVAL;
+
 	ptr = nilfs_direct_get_ptr(bmap, key);
 	if (ptr == NILFS_BMAP_INVALID_PTR)
 		return -EINVAL;
-- 
2.43.0

On Fri, 2026-09-04 at 02:23 +0900, Ryusuke Konishi wrote:
> nilfs_direct_propagate() is responsible for updating the virtual
> block
> number associated with a dirty data block in the direct mapping.
> 
> It is not designed to handle intermediate node blocks.  Furthermore,
> it
> assumes that the block offset of the passed buffer head is within the
> range of NILFS_DIRECT_KEY_MAX; otherwise, an out-of-bounds memory
> access
> could occur within the inode containing the bmap root.
> 
> While such inconsistencies stem from bugs, they can cause silent,
> harmful side effects unless a debug kernel is used - as was the case
> with a recent slab out-of-bounds access issue found in this function.
> 
> Therefore, issue a kernel warning via WARN_ON_ONCE() and return -
> EINVAL
> for these anomalies, allowing the bmap layer to handle the situation
> as
> a filesystem error.
> 
> Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
> ---
> Hi Viacheslav,
> 
> Please queue this for the next cycle.
> 
> While the recent out-of-bounds memory access issue in
> nilfs_direct_propagate() has already been fixed, this adds extra
> checks
> to catch and gracefully handle similar potential bugs.
> 
> Thanks,
> Ryusuke Konishi
> 
>  fs/nilfs2/direct.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c
> index b8643d3aa2f8..64da677dc8d4 100644
> --- a/fs/nilfs2/direct.c
> +++ b/fs/nilfs2/direct.c
> @@ -270,8 +270,14 @@ static int nilfs_direct_propagate(struct
> nilfs_bmap *bmap,
>  	if (!NILFS_BMAP_USE_VBN(bmap))
>  		return 0;
>  
> +	if (WARN_ON_ONCE(buffer_nilfs_node(bh)))
> +		return -EINVAL;
> +
>  	dat = nilfs_bmap_get_dat(bmap);
>  	key = nilfs_bmap_data_get_key(bmap, bh);
> +	if (WARN_ON_ONCE(key > NILFS_DIRECT_KEY_MAX))
> +		return -EINVAL;
> +
>  	ptr = nilfs_direct_get_ptr(bmap, key);
>  	if (ptr == NILFS_BMAP_INVALID_PTR)
>  		return -EINVAL;

Applied.

Thanks,
Slava.