* [PATCH] f2fs: validate MOVE_RANGE destination size
@ 2026-06-30 3:17 ` Wenjie Qi
0 siblings, 0 replies; 8+ messages in thread
From: Wenjie Qi @ 2026-06-30 3:17 UTC (permalink / raw)
To: jaegeuk, chao; +Cc: linux-f2fs-devel, linux-kernel, stable, qiwenjie, qwjhust
F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end
before updating i_size. A source hole can expose this: __clone_blkaddrs()
skips NULL_ADDR entries and returns success, so the caller can still extend
the destination inode with unchecked pos_out + len.
Reject destination overflow and use inode_newsize_ok() before extending
the destination inode.
Fixes: 4dd6f977fc77 ("f2fs: support an ioctl to move a range of data blocks")
Cc: stable@kernel.org
Assisted-by: Codex:gpt-5.5
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
---
fs/f2fs/file.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 4b52c56d71f0..2a5c6f741f56 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -3121,8 +3121,9 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
struct inode *dst = file_inode(file_out);
struct f2fs_sb_info *sbi = F2FS_I_SB(src);
struct f2fs_lock_context lc;
- size_t olen = len, dst_max_i_size = 0;
- size_t dst_osize;
+ size_t olen = len;
+ loff_t dst_max_i_size = 0;
+ loff_t dst_osize, dst_end;
int ret;
if (file_in->f_path.mnt != file_out->f_path.mnt ||
@@ -3179,8 +3180,15 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
}
dst_osize = dst->i_size;
- if (pos_out + olen > dst->i_size)
- dst_max_i_size = pos_out + olen;
+ if (olen > LLONG_MAX - pos_out)
+ goto out_unlock;
+ dst_end = pos_out + olen;
+ if (dst_end > dst->i_size) {
+ ret = inode_newsize_ok(dst, dst_end);
+ if (ret)
+ goto out_unlock;
+ dst_max_i_size = dst_end;
+ }
/* verify the end result is block aligned */
if (!IS_ALIGNED(pos_in, F2FS_BLKSIZE) ||
--
2.43.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [f2fs-dev] [PATCH] f2fs: validate MOVE_RANGE destination size
2026-06-30 3:17 ` Wenjie Qi
@ 2026-07-20 5:30 ` Wenjie Qi
-1 siblings, 0 replies; 8+ messages in thread
From: Wenjie Qi @ 2026-07-20 5:30 UTC (permalink / raw)
To: jaegeuk, chao; +Cc: stable, qiwenjie, linux-kernel, linux-f2fs-devel
ping
On Tue, Jun 30, 2026 at 11:17 AM Wenjie Qi <qwjhust@gmail.com> wrote:
>
> F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end
> before updating i_size. A source hole can expose this: __clone_blkaddrs()
> skips NULL_ADDR entries and returns success, so the caller can still extend
> the destination inode with unchecked pos_out + len.
>
> Reject destination overflow and use inode_newsize_ok() before extending
> the destination inode.
>
> Fixes: 4dd6f977fc77 ("f2fs: support an ioctl to move a range of data blocks")
> Cc: stable@kernel.org
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
> ---
> fs/f2fs/file.c | 16 ++++++++++++----
> 1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
> index 4b52c56d71f0..2a5c6f741f56 100644
> --- a/fs/f2fs/file.c
> +++ b/fs/f2fs/file.c
> @@ -3121,8 +3121,9 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
> struct inode *dst = file_inode(file_out);
> struct f2fs_sb_info *sbi = F2FS_I_SB(src);
> struct f2fs_lock_context lc;
> - size_t olen = len, dst_max_i_size = 0;
> - size_t dst_osize;
> + size_t olen = len;
> + loff_t dst_max_i_size = 0;
> + loff_t dst_osize, dst_end;
> int ret;
>
> if (file_in->f_path.mnt != file_out->f_path.mnt ||
> @@ -3179,8 +3180,15 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
> }
>
> dst_osize = dst->i_size;
> - if (pos_out + olen > dst->i_size)
> - dst_max_i_size = pos_out + olen;
> + if (olen > LLONG_MAX - pos_out)
> + goto out_unlock;
> + dst_end = pos_out + olen;
> + if (dst_end > dst->i_size) {
> + ret = inode_newsize_ok(dst, dst_end);
> + if (ret)
> + goto out_unlock;
> + dst_max_i_size = dst_end;
> + }
>
> /* verify the end result is block aligned */
> if (!IS_ALIGNED(pos_in, F2FS_BLKSIZE) ||
> --
> 2.43.0
>
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] f2fs: validate MOVE_RANGE destination size
@ 2026-07-20 5:30 ` Wenjie Qi
0 siblings, 0 replies; 8+ messages in thread
From: Wenjie Qi @ 2026-07-20 5:30 UTC (permalink / raw)
To: jaegeuk, chao; +Cc: linux-f2fs-devel, linux-kernel, stable, qiwenjie
ping
On Tue, Jun 30, 2026 at 11:17 AM Wenjie Qi <qwjhust@gmail.com> wrote:
>
> F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end
> before updating i_size. A source hole can expose this: __clone_blkaddrs()
> skips NULL_ADDR entries and returns success, so the caller can still extend
> the destination inode with unchecked pos_out + len.
>
> Reject destination overflow and use inode_newsize_ok() before extending
> the destination inode.
>
> Fixes: 4dd6f977fc77 ("f2fs: support an ioctl to move a range of data blocks")
> Cc: stable@kernel.org
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
> ---
> fs/f2fs/file.c | 16 ++++++++++++----
> 1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
> index 4b52c56d71f0..2a5c6f741f56 100644
> --- a/fs/f2fs/file.c
> +++ b/fs/f2fs/file.c
> @@ -3121,8 +3121,9 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
> struct inode *dst = file_inode(file_out);
> struct f2fs_sb_info *sbi = F2FS_I_SB(src);
> struct f2fs_lock_context lc;
> - size_t olen = len, dst_max_i_size = 0;
> - size_t dst_osize;
> + size_t olen = len;
> + loff_t dst_max_i_size = 0;
> + loff_t dst_osize, dst_end;
> int ret;
>
> if (file_in->f_path.mnt != file_out->f_path.mnt ||
> @@ -3179,8 +3180,15 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
> }
>
> dst_osize = dst->i_size;
> - if (pos_out + olen > dst->i_size)
> - dst_max_i_size = pos_out + olen;
> + if (olen > LLONG_MAX - pos_out)
> + goto out_unlock;
> + dst_end = pos_out + olen;
> + if (dst_end > dst->i_size) {
> + ret = inode_newsize_ok(dst, dst_end);
> + if (ret)
> + goto out_unlock;
> + dst_max_i_size = dst_end;
> + }
>
> /* verify the end result is block aligned */
> if (!IS_ALIGNED(pos_in, F2FS_BLKSIZE) ||
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [f2fs-dev] [PATCH] f2fs: validate MOVE_RANGE destination size
2026-06-30 3:17 ` Wenjie Qi
@ 2026-08-03 3:04 ` Chao Yu
-1 siblings, 0 replies; 8+ messages in thread
From: Chao Yu via Linux-f2fs-devel @ 2026-08-03 3:04 UTC (permalink / raw)
To: Wenjie Qi, jaegeuk; +Cc: stable, qiwenjie, linux-kernel, linux-f2fs-devel
On 6/30/26 11:17, Wenjie Qi wrote:
> F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end
> before updating i_size. A source hole can expose this: __clone_blkaddrs()
> skips NULL_ADDR entries and returns success, so the caller can still extend
> the destination inode with unchecked pos_out + len.
>
> Reject destination overflow and use inode_newsize_ok() before extending
> the destination inode.
>
> Fixes: 4dd6f977fc77 ("f2fs: support an ioctl to move a range of data blocks")
> Cc: stable@kernel.org
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Thanks,
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] f2fs: validate MOVE_RANGE destination size
@ 2026-08-03 3:04 ` Chao Yu
0 siblings, 0 replies; 8+ messages in thread
From: Chao Yu @ 2026-08-03 3:04 UTC (permalink / raw)
To: Wenjie Qi, jaegeuk; +Cc: chao, linux-f2fs-devel, linux-kernel, stable, qiwenjie
On 6/30/26 11:17, Wenjie Qi wrote:
> F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end
> before updating i_size. A source hole can expose this: __clone_blkaddrs()
> skips NULL_ADDR entries and returns success, so the caller can still extend
> the destination inode with unchecked pos_out + len.
>
> Reject destination overflow and use inode_newsize_ok() before extending
> the destination inode.
>
> Fixes: 4dd6f977fc77 ("f2fs: support an ioctl to move a range of data blocks")
> Cc: stable@kernel.org
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Thanks,
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [f2fs-dev] [PATCH] f2fs: validate MOVE_RANGE destination size
2026-06-30 3:17 ` Wenjie Qi
@ 2026-08-05 21:20 ` patchwork-bot+f2fs
-1 siblings, 0 replies; 8+ messages in thread
From: patchwork-bot+f2fs--- via Linux-f2fs-devel @ 2026-08-05 21:20 UTC (permalink / raw)
To: Wenjie Qi; +Cc: linux-kernel, linux-f2fs-devel, qiwenjie, jaegeuk, stable
Hello:
This patch was applied to jaegeuk/f2fs.git (dev)
by Jaegeuk Kim <jaegeuk@kernel.org>:
On Tue, 30 Jun 2026 11:17:00 +0800 you wrote:
> F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end
> before updating i_size. A source hole can expose this: __clone_blkaddrs()
> skips NULL_ADDR entries and returns success, so the caller can still extend
> the destination inode with unchecked pos_out + len.
>
> Reject destination overflow and use inode_newsize_ok() before extending
> the destination inode.
>
> [...]
Here is the summary with links:
- [f2fs-dev] f2fs: validate MOVE_RANGE destination size
https://git.kernel.org/jaegeuk/f2fs/c/e533889fc26a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [f2fs-dev] [PATCH] f2fs: validate MOVE_RANGE destination size
@ 2026-08-05 21:20 ` patchwork-bot+f2fs
0 siblings, 0 replies; 8+ messages in thread
From: patchwork-bot+f2fs @ 2026-08-05 21:20 UTC (permalink / raw)
To: Wenjie Qi; +Cc: jaegeuk, chao, stable, qiwenjie, linux-kernel, linux-f2fs-devel
Hello:
This patch was applied to jaegeuk/f2fs.git (dev)
by Jaegeuk Kim <jaegeuk@kernel.org>:
On Tue, 30 Jun 2026 11:17:00 +0800 you wrote:
> F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end
> before updating i_size. A source hole can expose this: __clone_blkaddrs()
> skips NULL_ADDR entries and returns success, so the caller can still extend
> the destination inode with unchecked pos_out + len.
>
> Reject destination overflow and use inode_newsize_ok() before extending
> the destination inode.
>
> [...]
Here is the summary with links:
- [f2fs-dev] f2fs: validate MOVE_RANGE destination size
https://git.kernel.org/jaegeuk/f2fs/c/e533889fc26a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 8+ messages in thread