From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pz2-f42.google.com (mail-pz2-f42.google.com [74.125.228.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ABA1B42E8F0 for ; Thu, 24 Sep 2026 07:39:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790235568; cv=none; b=jdBnW4qvHN5RLPmeLS1pJKWCj6vTApSg+2IbxkAt4kbQJwIb9Ub4I0IGpetOLutngXoxc2qRSegW0dfWyIDValcZldOS6v0RJaV2sEgQn4sCZ8G5Tcuf5PbUs/3sebZhG9AG5SuHsHLm2xWc6jDSPjM5UXaWHZh/8Zw29MxF5t4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790235568; c=relaxed/simple; bh=y6ChmsjQ++3k35jLXB4KQNbWrTjxMp75K8wX+AXVsZw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=U9rKIE0/neu26PVE4RQH/G4g69DwdXN8onqgS4jlC7mTrjNJIw5Y+NMyvKAHhUDNBayo1dYvYKS+beccumtuUdNgHIFP01HmtkGFtBm5DGVGkLTIH/exwOpqbTO7lNreWMKqetIiJsrB9DCzettf9B/vol2mFuYyWYuknS5zXcE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RxO6AFOH; arc=none smtp.client-ip=74.125.228.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RxO6AFOH" Received: by mail-pz2-f42.google.com with SMTP id d2e1a72fcca58-86efece610cso911019b3a.0 for ; Thu, 24 Sep 2026 00:39:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790235562; x=1790840362; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fv0RW6TwCjxSURRvA9N6M4UqvR2d6pgu7b/r8/8yzS8=; b=RxO6AFOH2kXb+DommL5UIH1VV74yswS/YXYUz1Oob8y/YXxtZYlYr8312yll5QhiMu VykEfZ208hl/kguDfoL/+3eKVy0AghgpWD3ahg2G0BFPpdiuto4vXaTrMM2d+ct0n8/a ySIBN7vD2BnklHhef6W0RUBbqZKajrwmrVX0hyoPGMB2nZC1Ldi19Y+QgfhNycaJe7FT wBGk+ZFhHiPuqB92SCwWhLTyxblm5fQqbdTK/olVMinEee0T29+hgfIOykx92BWf8bsZ 1llgpLPKoeHmEc+otHVADj8tDdgL6bTwNvKfD+bKoQwZxWQNvEhsBKDvj2QBk8jUWR2Z zQjw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790235562; x=1790840362; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=fv0RW6TwCjxSURRvA9N6M4UqvR2d6pgu7b/r8/8yzS8=; b=bw15McKL6qEMk1qcexW+M2TW3mtRYsljHyJJIYuCYenbVxZXgedRtGG289F7fnlJ9L zA+1RChs1qWvOf2nRbD56MfcV/0/26+J9iwvgmRYLL6Ze2//OU+tufg3LAL0uJuDDIlI DF2iSipAp4LyEj1/5CPZY+MqXIThzL5JFpJ/pp4jy+ylyKh9/TXDWqxq/mCOqqNTP2WQ hMBuwvIRkg1Yb2SYQwguBxrM1a+M7x2ATb5RI1ad9iZz/NS+EhKWCJLp3qT6UPcW+XIK 3L+YLz2Cs+9hZVuVUiqBectJxnW+KfTrv6tyYJ7Kf54HSZsJwa4VL1jPpDW3ReLKl1qH BeTw== X-Gm-Message-State: AFuF++l9ZtazMFVA/Tqt8hXYnw8B58gyyQ2nrg9IIn7pJqGDqzlqEzet HuWohuxWc8RWrH7Ca8U0oC19ntp0/5V499OMv4s/yjasVC1Q5RN+oHe0 X-Gm-Gg: AYBFou0fWSy0bLneL0YW2533sHxtG1F5nQO7E7zb2ZFz0lSRQQiJfIkZR8n69Qe48j7 9ete4kCxgzUZBQivV0Rr9oBIyCqcCNjWTm8yKXi2C1Drhjsie/gmJ1ldgjUSCD+oIcve1i675ZW kpsBLwfpGZeswFvygCTXO2hZ0mvUxfNGUUsP4JKON/9AF0rM1OuedfOQ5jZkM1ArlC7gUT3Ocv/ qmNvcH7nK9AaUBzkXlGoFmJ4PK8QAbZ4vSiOW4+anJ1ItGr/e1B7jI4oI81fjg9TLwnQDPnclBw haYnqzNYPcuvFJFYPurHWzGa4jY4ZtbdTygnM8MSrAeKdZI0Xl8P/MnzGAkHULcmXzt23UyyvWd wqHbF6VcT8rmw7GdUREFarD7Tgj8Vs2Ivy6u5g0KYEgl8+KJFggG6q25/N/H8x8BYYNIXtdYDUZ Bp8ZwW6CSLobjsW5IT7yzAOjKe2TMJwSOCYVdPxI0uxDQLMaHk/nmvpi4cPg9LCY4cjFQXx130I ybJKxKyBR7r3nNuLOaMZG1C+BmVTT/ZNg1w+BIDBSa7UWNlr0QCBsEiq49U30cilQTblLo/HmyE lNsxSFFrxQ== X-Received: by 2002:a05:6a00:ac8:b0:874:708d:b62f with SMTP id d2e1a72fcca58-87e9b896bfemr1262761b3a.27.1790235562102; Thu, 24 Sep 2026 00:39:22 -0700 (PDT) Received: from phui-2.c.googlers.com.com (67.51.127.34.bc.googleusercontent.com. [34.127.51.67]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-87d1dad44c6sm2393739b3a.42.2026.09.24.00.39.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Sep 2026 00:39:21 -0700 (PDT) From: Hui Peng To: al@alarsen.net Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, matthias.goergens@gmail.com, Hui Peng Subject: [PATCH v3 1/6] qnx6: validate di_filelevels in qnx6_iget() before accessing level pointers Date: Thu, 24 Sep 2026 07:39:14 +0000 Message-ID: <20260924073920.2782917-2-benquike@gmail.com> X-Mailer: git-send-email 2.56.0.rc1.310.g51773c2048-goog In-Reply-To: <20260921042511.1473629-2-benquike@gmail.com> References: <20260921042511.1473629-1-benquike@gmail.com> <20260921042511.1473629-2-benquike@gmail.com> Precedence: bulk X-Mailing-List: linux-fsdevel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In qnx6_iget(), raw_inode->di_filelevels is read directly from the disk image and stored into qnx6_inode->di_filelevels without checking if it exceeds QNX6_PTR_MAX_LEVELS (3). If a corrupted disk image contains di_filelevels > 3, subsequent file operations using qnx6_block_map() access qnx6_inode->di_ptr[] past its array bound, causing out-of-bounds reads and memory corruption. Validate raw_inode->di_filelevels <= QNX6_PTR_MAX_LEVELS in qnx6_iget() and return -EIO on corrupt inodes. Fixes: 5d026c724220 ("fs: initial qnx6fs addition") Cc: stable@vger.kernel.org Tested-by: Matthias Goergens Reviewed-by: Matthias Goergens Assisted-by: LLM Signed-off-by: Hui Peng --- Changes in v3: - Add Tested-by and Reviewed-by tags from Matthias Goergens. - Update Fixes: tag SHA to 5d026c724220 ("fs: initial qnx6fs addition"). Changes in v2: - Split out as patch 1/6 as requested by maintainers. fs/qnx6/inode.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/qnx6/inode.c b/fs/qnx6/inode.c index a15c4de4f794..e1981e4ae47d 100644 --- a/fs/qnx6/inode.c +++ b/fs/qnx6/inode.c @@ -547,6 +547,11 @@ struct inode *qnx6_iget(struct super_block *sb, unsigned ino) qnx6_inode->di_filelevels = raw_inode->di_filelevels; qnx6_inode->di_status = raw_inode->di_status; + if (qnx6_inode->di_filelevels > QNX6_PTR_MAX_LEVELS) { + pr_err("invalid di_filelevels %u\n", qnx6_inode->di_filelevels); + iget_failed(inode); + return ERR_PTR(-EIO); + } if (S_ISDIR(inode->i_mode) || S_ISREG(inode->i_mode)) { memcpy(qnx6_inode->di_ptr, raw_inode->di_ptr, sizeof(qnx6_inode->di_ptr)); -- 2.55.0.1082.g2b9226bbc0-goog