[PATCH 6.12.y] reiserfs: reject direct items that span block buffers

[PATCH 6.12.y] reiserfs: reject direct items that span block buffers

[Kyle Zeng]

Direct-item read, writeback, and tail-conversion paths assume that
the direct item bytes selected for one logical block fit in the mapped
page or block buffer. A crafted filesystem image can chain direct items
so a read starts near the end of a page and then copies the next direct
item past the page-cache page.

Track the remaining mapped-buffer bytes in the read and writeback paths,
and reject direct-to-indirect conversion when a direct item or accumulated
tail would cross the target block. Treat this as malformed metadata and
fail with -EIO instead of copying outside the mapped buffer.

Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 fs/reiserfs/inode.c           | 25 +++++++++++++++++++++++--
 fs/reiserfs/tail_conversion.c |  9 +++++++++
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index d39ee5f..d091664 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -296,6 +296,7 @@ static int _get_block_create_0(struct inode *inode, sector_t block,
 	int result;
 	int done = 0;
 	unsigned long offset;
+	int bytes_left;
 
 	/* prepare the key to look for the 'block'-th block of file */
 	make_cpu_key(&key, inode,
@@ -392,7 +393,10 @@ static int _get_block_create_0(struct inode *inode, sector_t block,
 	 */
 	p = (char *)kmap(bh_result->b_page);
 	p += offset;
-	memset(p, 0, inode->i_sb->s_blocksize);
+	bytes_left = min_t(unsigned int, bh_result->b_size,
+			   inode->i_sb->s_blocksize);
+	bytes_left = min_t(unsigned int, bytes_left, PAGE_SIZE - offset);
+	memset(p, 0, bytes_left);
 	do {
 		if (!is_direct_le_ih(ih)) {
 			BUG();
@@ -413,12 +417,19 @@ static int _get_block_create_0(struct inode *inode, sector_t block,
 		} else {
 			chars = ih_item_len(ih) - path.pos_in_item;
 		}
+		if (chars <= 0 || chars > bytes_left) {
+			result = IO_ERROR;
+			break;
+		}
 		memcpy(p, ih_item_body(bh, ih) + path.pos_in_item, chars);
+		bytes_left -= chars;
 
 		if (done)
 			break;
 
 		p += chars;
+		if (!bytes_left)
+			break;
 
 		/*
 		 * we done, if read direct item is not the last item of
@@ -2363,6 +2374,7 @@ static int map_block_for_writepage(struct inode *inode,
 	int bytes_copied = 0;
 	int copy_size;
 	int trans_running = 0;
+	int bytes_left;
 
 	/*
 	 * catch places below that try to log something without
@@ -2375,6 +2387,10 @@ static int map_block_for_writepage(struct inode *inode,
 	}
 
 	kmap(bh_result->b_page);
+	bytes_left = min_t(unsigned int, bh_result->b_size,
+			   inode->i_sb->s_blocksize);
+	bytes_left = min_t(unsigned int, bytes_left,
+			   PAGE_SIZE - ((byte_offset - 1) & (PAGE_SIZE - 1)));
 start_over:
 	reiserfs_write_lock(inode->i_sb);
 	make_cpu_key(&key, inode, byte_offset, TYPE_ANY, 3);
@@ -2409,6 +2425,11 @@ research:
 		p = page_address(bh_result->b_page);
 		p += (byte_offset - 1) & (PAGE_SIZE - 1);
 		copy_size = ih_item_len(ih) - pos_in_item;
+		if (copy_size <= 0 || bytes_copied >= bytes_left ||
+		    copy_size > bytes_left - bytes_copied) {
+			retval = -EIO;
+			goto out;
+		}
 
 		fs_gen = get_generation(inode->i_sb);
 		copy_item_head(&tmp_ih, ih);
@@ -2444,7 +2465,7 @@ research:
 		set_block_dev_mapped(bh_result, 0, inode);
 
 		/* are there still bytes left? */
-		if (bytes_copied < bh_result->b_size &&
+		if (bytes_copied < bytes_left &&
 		    (byte_offset + bytes_copied) < inode->i_size) {
 			set_cpu_key_k_offset(&key,
 					     cpu_key_k_offset(&key) +
diff --git a/fs/reiserfs/tail_conversion.c b/fs/reiserfs/tail_conversion.c
index 2cec61a..cf11ec0 100644
--- a/fs/reiserfs/tail_conversion.c
+++ b/fs/reiserfs/tail_conversion.c
@@ -122,6 +122,15 @@ int direct2indirect(struct reiserfs_transaction_handle *th, struct inode *inode,
 		       &end_key, p_le_ih);
 		tail_size = (le_ih_k_offset(p_le_ih) & (blk_size - 1))
 		    + ih_item_len(p_le_ih) - 1;
+		if (tail_size > blk_size ||
+		    total_tail > blk_size ||
+		    ih_item_len(p_le_ih) > blk_size - total_tail) {
+			reiserfs_error(sb, "PAP-14060",
+				       "direct item %h for inode %lu spans block",
+				       p_le_ih, inode->i_ino);
+			pathrelse(path);
+			return -EIO;
+		}
 
 		/*
 		 * we only send the unbh pointer if the buffer is not
-- 
2.54.0

Re: [PATCH 6.12.y] reiserfs: reject direct items that span block buffers

[Sasha Levin]

On Thu, Jun 11, 2026 at 03:39:44PM -0700, Kyle Zeng wrote:
> Track the remaining mapped-buffer bytes in the read and writeback paths,
> and reject direct-to-indirect conversion when a direct item or accumulated
> tail would cross the target block.

Thanks for the fix. I can't queue this for stable: reiserfs was removed from
mainline in 6.13, so there's no upstream commit (and can't be), and there's no
maintainer Reviewed-by/Acked-by (the subsystem is obsolete).  I won't take a
stable-only change for a removed subsystem without upstream presence or a
maintainer ack.

If you can get subsystem review/ack, I'll reconsider. Note exploitation here
also requires mounting a crafted image.

--
Thanks,
Sasha