Re: [syzbot] Re: kernel BUG in __block_write_begin_int (3)

[syzbot <syzbot+d6ca2daf692c7a82f959@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: kernel BUG in __block_write_begin_int (3)
Author: dmantipov@yandex.ru

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git c964ced7726294d40913f2127c3f185a92cb4a41

diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c
index fe5b1a30c509..57108bd90e8b 100644
--- a/fs/nilfs2/dir.c
+++ b/fs/nilfs2/dir.c
@@ -483,6 +483,13 @@ int nilfs_add_link(struct dentry *dentry, struct inode *inode)
  got_it:
  	from = offset_in_folio(folio, de);
  	to = from + rec_len;
+	if (unlikely(to > folio_size(folio))) {
+		nilfs_error(dir->i_sb, "bad entry in directory #%lu:"
+			    " from=%zu to=%zu size=%zu", dir->i_ino,
+			    from, to, folio_size(folio));
+		err = -EINVAL;
+		goto out_unlock;
+	}
  	err = nilfs_prepare_chunk(folio, from, to);
  	if (err)
  		goto out_unlock;