[PATCH 6.12.y] reiserfs: validate tail item bounds before conversion

[PATCH 6.12.y] reiserfs: validate tail item bounds before conversion

[Kyle Zeng]

direct2indirect() moves direct items into an unformatted-node page while
deleting them from the tree. It assumes the item body copied by
reiserfs_delete_item() and the aggregate number of copied tail bytes both
fit in the target tail page.

A corrupted filesystem can violate those assumptions. Multiple direct
items can each fit in the page while their aggregate length exceeds the
filesystem block size, which underflows the final zero-fill length. A
malformed item can also describe an offset and length that cross the page
boundary before the aggregate length is checked.

Validate the per-item page copy and aggregate tail length before calling
reiserfs_delete_item(), and reject corrupt metadata with -EIO after
reporting a filesystem error.

Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 fs/reiserfs/tail_conversion.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/fs/reiserfs/tail_conversion.c b/fs/reiserfs/tail_conversion.c
index 2cec61af2a9e..ba3dd6770d46 100644
--- a/fs/reiserfs/tail_conversion.c
+++ b/fs/reiserfs/tail_conversion.c
@@ -106,6 +106,8 @@ int direct2indirect(struct reiserfs_transaction_handle *th, struct inode *inode,
 	 * and delete them.
 	 */
 	while (1) {
+		unsigned long item_len;
+		unsigned long pgoff;
 		int tail_size;
 
 		/*
@@ -120,6 +122,17 @@ int direct2indirect(struct reiserfs_transaction_handle *th, struct inode *inode,
 		RFALSE(!is_direct_le_ih(p_le_ih),
 		       "vs-14055: direct item expected(%K), found %h",
 		       &end_key, p_le_ih);
+		item_len = ih_item_len(p_le_ih);
+		pgoff = (le_ih_k_offset(p_le_ih) - 1) & (PAGE_SIZE - 1);
+		if (item_len > PAGE_SIZE - pgoff ||
+		    item_len > blk_size ||
+		    total_tail > blk_size - item_len) {
+			reiserfs_error(sb, "PAP-14060",
+				       "direct item %h does not fit in tail page",
+				       p_le_ih);
+			pathrelse(path);
+			return -EIO;
+		}
 		tail_size = (le_ih_k_offset(p_le_ih) & (blk_size - 1))
 		    + ih_item_len(p_le_ih) - 1;
 
-- 
2.54.0

Re: [PATCH 6.12.y] reiserfs: validate tail item bounds before conversion

[Sasha Levin]

On Thu, Jun 11, 2026 at 03:40:27PM -0700, Kyle Zeng wrote:
> Validate the per-item page copy and aggregate tail length before calling
> reiserfs_delete_item(), and reject corrupt metadata with -EIO after
> reporting a filesystem error.

Thanks for the fix. Same as your other reiserfs patch: no upstream
commit (reiserfs was removed in 6.13) and no maintainer ack, so I can't
queue a stable-only change for a removed subsystem on my own.

If you can get subsystem review/ack, I'll reconsider. As before,
exploitation requires mounting a crafted image.

--
Thanks,
Sasha