[PATCH] fsck.f2fs: sanitize invalid segment type during block update

[PATCH] fsck.f2fs: sanitize invalid segment type during block update

[Daeho Jeong]

From: Daeho Jeong <daehojeong@google.com>

If an invalid segment type (type < 0 || type >= NO_CHECK_TYPE) is read
from SIT during block update, update_block() now validates the type,
reports corruption, and falls back to a valid active curseg type when
fix_on is enabled. find_next_free_block() also validates want_type to
prevent out-of-bounds accesses.

Signed-off-by: Daeho Jeong <daehojeong@google.com>
---
 fsck/mount.c   |  5 +++++
 fsck/segment.c | 14 ++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/fsck/mount.c b/fsck/mount.c
index 85ed404..ce96a44 100644
--- a/fsck/mount.c
+++ b/fsck/mount.c
@@ -3059,6 +3059,11 @@ int find_next_free_block(struct f2fs_sb_info *sbi, u64 *to, int left,
 	u64 end_blkaddr = (get_sb(segment_count_main) <<
 			get_sb(log_blocks_per_seg)) + get_sb(main_blkaddr);
 
+	if (want_type < 0 || want_type >= NO_CHECK_TYPE) {
+		ERR_MSG("Invalid segment type %d for block allocation\n", want_type);
+		return -EINVAL;
+	}
+
 	if (c.zoned_model == F2FS_ZONED_HM && !new_sec) {
 		struct curseg_info *curseg = CURSEG_I(sbi, want_type);
 		unsigned int segs_per_zone = sbi->segs_per_sec * sbi->secs_per_zone;
diff --git a/fsck/segment.c b/fsck/segment.c
index 46dc747..1ae90bf 100644
--- a/fsck/segment.c
+++ b/fsck/segment.c
@@ -779,6 +779,20 @@ int update_block(struct f2fs_sb_info *sbi, void *buf, u32 *blkaddr,
 	se = get_seg_entry(sbi, GET_SEGNO(sbi, old_blkaddr));
 	offset = OFFSET_IN_SEG(sbi, old_blkaddr);
 	type = se->type;
+	if (type < 0 || type >= NO_CHECK_TYPE) {
+		MSG(0, "[FSCK] Invalid SIT segment type %d at blkaddr 0x%"PRIx64"\n",
+				type, old_blkaddr);
+		c.bug_on = 1;
+
+		if (!c.fix_on)
+			return -EINVAL;
+
+		int fixed_type = IS_NODESEG(type) ? CURSEG_HOT_NODE : CURSEG_HOT_DATA;
+
+		FIX_MSG("Correct invalid segment type %d -> %d for blkaddr 0x%"PRIx64"\n",
+				type, fixed_type, old_blkaddr);
+		type = fixed_type;
+	}
 	se->valid_blocks--;
 	f2fs_clear_bit(offset, (char *)se->cur_valid_map);
 	if (need_fsync_data_record(sbi))
-- 
2.55.0.229.g6434b31f56-goog

[f2fs-dev] [PATCH] fsck.f2fs: sanitize invalid segment type during block update

[Daeho Jeong]

From: Daeho Jeong <daehojeong@google.com>

If an invalid segment type (type < 0 || type >= NO_CHECK_TYPE) is read
from SIT during block update, update_block() now validates the type,
reports corruption, and falls back to a valid active curseg type when
fix_on is enabled. find_next_free_block() also validates want_type to
prevent out-of-bounds accesses.

Signed-off-by: Daeho Jeong <daehojeong@google.com>
---
 fsck/mount.c   |  5 +++++
 fsck/segment.c | 14 ++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/fsck/mount.c b/fsck/mount.c
index 85ed404..ce96a44 100644
--- a/fsck/mount.c
+++ b/fsck/mount.c
@@ -3059,6 +3059,11 @@ int find_next_free_block(struct f2fs_sb_info *sbi, u64 *to, int left,
 	u64 end_blkaddr = (get_sb(segment_count_main) <<
 			get_sb(log_blocks_per_seg)) + get_sb(main_blkaddr);
 
+	if (want_type < 0 || want_type >= NO_CHECK_TYPE) {
+		ERR_MSG("Invalid segment type %d for block allocation\n", want_type);
+		return -EINVAL;
+	}
+
 	if (c.zoned_model == F2FS_ZONED_HM && !new_sec) {
 		struct curseg_info *curseg = CURSEG_I(sbi, want_type);
 		unsigned int segs_per_zone = sbi->segs_per_sec * sbi->secs_per_zone;
diff --git a/fsck/segment.c b/fsck/segment.c
index 46dc747..1ae90bf 100644
--- a/fsck/segment.c
+++ b/fsck/segment.c
@@ -779,6 +779,20 @@ int update_block(struct f2fs_sb_info *sbi, void *buf, u32 *blkaddr,
 	se = get_seg_entry(sbi, GET_SEGNO(sbi, old_blkaddr));
 	offset = OFFSET_IN_SEG(sbi, old_blkaddr);
 	type = se->type;
+	if (type < 0 || type >= NO_CHECK_TYPE) {
+		MSG(0, "[FSCK] Invalid SIT segment type %d at blkaddr 0x%"PRIx64"\n",
+				type, old_blkaddr);
+		c.bug_on = 1;
+
+		if (!c.fix_on)
+			return -EINVAL;
+
+		int fixed_type = IS_NODESEG(type) ? CURSEG_HOT_NODE : CURSEG_HOT_DATA;
+
+		FIX_MSG("Correct invalid segment type %d -> %d for blkaddr 0x%"PRIx64"\n",
+				type, fixed_type, old_blkaddr);
+		type = fixed_type;
+	}
 	se->valid_blocks--;
 	f2fs_clear_bit(offset, (char *)se->cur_valid_map);
 	if (need_fsync_data_record(sbi))
-- 
2.55.0.229.g6434b31f56-goog



_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: [f2fs-dev] [PATCH] fsck.f2fs: sanitize invalid segment type during block update

[Chao Yu via Linux-f2fs-devel]

On 7/24/26 04:02, Daeho Jeong wrote:
> From: Daeho Jeong <daehojeong@google.com>
> 
> If an invalid segment type (type < 0 || type >= NO_CHECK_TYPE) is read
> from SIT during block update, update_block() now validates the type,
> reports corruption, and falls back to a valid active curseg type when
> fix_on is enabled. find_next_free_block() also validates want_type to
> prevent out-of-bounds accesses.
> 
> Signed-off-by: Daeho Jeong <daehojeong@google.com>
> ---
>   fsck/mount.c   |  5 +++++
>   fsck/segment.c | 14 ++++++++++++++
>   2 files changed, 19 insertions(+)
> 
> diff --git a/fsck/mount.c b/fsck/mount.c
> index 85ed404..ce96a44 100644
> --- a/fsck/mount.c
> +++ b/fsck/mount.c
> @@ -3059,6 +3059,11 @@ int find_next_free_block(struct f2fs_sb_info *sbi, u64 *to, int left,
>   	u64 end_blkaddr = (get_sb(segment_count_main) <<
>   			get_sb(log_blocks_per_seg)) + get_sb(main_blkaddr);
>   
> +	if (want_type < 0 || want_type >= NO_CHECK_TYPE) {
> +		ERR_MSG("Invalid segment type %d for block allocation\n", want_type);

Use ASSERT_MSG() instead? it can set c.bug_on.

> +		return -EINVAL;
> +	}
> +
>   	if (c.zoned_model == F2FS_ZONED_HM && !new_sec) {
>   		struct curseg_info *curseg = CURSEG_I(sbi, want_type);
>   		unsigned int segs_per_zone = sbi->segs_per_sec * sbi->secs_per_zone;
> diff --git a/fsck/segment.c b/fsck/segment.c
> index 46dc747..1ae90bf 100644
> --- a/fsck/segment.c
> +++ b/fsck/segment.c
> @@ -779,6 +779,20 @@ int update_block(struct f2fs_sb_info *sbi, void *buf, u32 *blkaddr,
>   	se = get_seg_entry(sbi, GET_SEGNO(sbi, old_blkaddr));
>   	offset = OFFSET_IN_SEG(sbi, old_blkaddr);
>   	type = se->type;
> +	if (type < 0 || type >= NO_CHECK_TYPE) {
> +		MSG(0, "[FSCK] Invalid SIT segment type %d at blkaddr 0x%"PRIx64"\n",
> +				type, old_blkaddr);
> +		c.bug_on = 1;

Ditto,

> +
> +		if (!c.fix_on)
> +			return -EINVAL;
> +
> +		int fixed_type = IS_NODESEG(type) ? CURSEG_HOT_NODE : CURSEG_HOT_DATA;
> +
> +		FIX_MSG("Correct invalid segment type %d -> %d for blkaddr 0x%"PRIx64"\n",
> +				type, fixed_type, old_blkaddr);
> +		type = fixed_type;

How about fixing se->type directly, otherwise we may fix this in local stack
repeatly whenever encounter this buggy se->type.

Please refer to fix_section_type().

Thanks,

> +	}
>   	se->valid_blocks--;
>   	f2fs_clear_bit(offset, (char *)se->cur_valid_map);
>   	if (need_fsync_data_record(sbi))



_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: [f2fs-dev] [PATCH] fsck.f2fs: sanitize invalid segment type during block update

[Chao Yu]

On 7/24/26 04:02, Daeho Jeong wrote:
> From: Daeho Jeong <daehojeong@google.com>
> 
> If an invalid segment type (type < 0 || type >= NO_CHECK_TYPE) is read
> from SIT during block update, update_block() now validates the type,
> reports corruption, and falls back to a valid active curseg type when
> fix_on is enabled. find_next_free_block() also validates want_type to
> prevent out-of-bounds accesses.
> 
> Signed-off-by: Daeho Jeong <daehojeong@google.com>
> ---
>   fsck/mount.c   |  5 +++++
>   fsck/segment.c | 14 ++++++++++++++
>   2 files changed, 19 insertions(+)
> 
> diff --git a/fsck/mount.c b/fsck/mount.c
> index 85ed404..ce96a44 100644
> --- a/fsck/mount.c
> +++ b/fsck/mount.c
> @@ -3059,6 +3059,11 @@ int find_next_free_block(struct f2fs_sb_info *sbi, u64 *to, int left,
>   	u64 end_blkaddr = (get_sb(segment_count_main) <<
>   			get_sb(log_blocks_per_seg)) + get_sb(main_blkaddr);
>   
> +	if (want_type < 0 || want_type >= NO_CHECK_TYPE) {
> +		ERR_MSG("Invalid segment type %d for block allocation\n", want_type);

Use ASSERT_MSG() instead? it can set c.bug_on.

> +		return -EINVAL;
> +	}
> +
>   	if (c.zoned_model == F2FS_ZONED_HM && !new_sec) {
>   		struct curseg_info *curseg = CURSEG_I(sbi, want_type);
>   		unsigned int segs_per_zone = sbi->segs_per_sec * sbi->secs_per_zone;
> diff --git a/fsck/segment.c b/fsck/segment.c
> index 46dc747..1ae90bf 100644
> --- a/fsck/segment.c
> +++ b/fsck/segment.c
> @@ -779,6 +779,20 @@ int update_block(struct f2fs_sb_info *sbi, void *buf, u32 *blkaddr,
>   	se = get_seg_entry(sbi, GET_SEGNO(sbi, old_blkaddr));
>   	offset = OFFSET_IN_SEG(sbi, old_blkaddr);
>   	type = se->type;
> +	if (type < 0 || type >= NO_CHECK_TYPE) {
> +		MSG(0, "[FSCK] Invalid SIT segment type %d at blkaddr 0x%"PRIx64"\n",
> +				type, old_blkaddr);
> +		c.bug_on = 1;

Ditto,

> +
> +		if (!c.fix_on)
> +			return -EINVAL;
> +
> +		int fixed_type = IS_NODESEG(type) ? CURSEG_HOT_NODE : CURSEG_HOT_DATA;
> +
> +		FIX_MSG("Correct invalid segment type %d -> %d for blkaddr 0x%"PRIx64"\n",
> +				type, fixed_type, old_blkaddr);
> +		type = fixed_type;

How about fixing se->type directly, otherwise we may fix this in local stack
repeatly whenever encounter this buggy se->type.

Please refer to fix_section_type().

Thanks,

> +	}
>   	se->valid_blocks--;
>   	f2fs_clear_bit(offset, (char *)se->cur_valid_map);
>   	if (need_fsync_data_record(sbi))