FAILED: patch "[PATCH] f2fs: validate MOVE_RANGE destination size" failed to apply to 6.12-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x e533889fc26aea0cd83c90327063f272061dd820
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090931-net-monotone-74ea@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From e533889fc26aea0cd83c90327063f272061dd820 Mon Sep 17 00:00:00 2001
From: Wenjie Qi <[email protected]>
Date: Tue, 30 Jun 2026 11:17:00 +0800
Subject: [PATCH] f2fs: validate MOVE_RANGE destination size
F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len.
Reject destination overflow and use inode_newsize_ok() before extending the destination inode.
fs/f2fs/file.c +12 -4
@@ -3127,8 +3127,9 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,struct inode *dst =file_inode (file_out);struct f2fs_sb_info *sbi =F2FS_I_SB (src);struct f2fs_lock_context lc; -size_t olen = len, dst_max_i_size =0 ; -size_t dst_osize; +size_t olen = len; +loff_t dst_max_i_size =0 ; +loff_t dst_osize, dst_end;int ret; if (file_in->f_path.mnt != file_out->f_path.mnt ||
@@ -3185,8 +3186,15 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in, } dst_osize = dst->i_size; -if (pos_out + olen > dst->i_size) - dst_max_i_size = pos_out + olen; +if (olen >LLONG_MAX - pos_out) + goto out_unlock; + dst_end = pos_out + olen; +if (dst_end > dst->i_size) { + ret =inode_newsize_ok (dst, dst_end); +if (ret) + goto out_unlock; + dst_max_i_size = dst_end; + }/* verify the end result is block aligned */ if (!IS_ALIGNED(pos_in, F2FS_BLKSIZE) ||
Sasha Levin
maintainerPATCH 1/1 f2fs: validate MOVE_RANGE destination size
From: Wenjie Qi <[email protected]>
[ Upstream commit e533889fc26aea0cd83c90327063f272061dd820 ]
F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len.
Reject destination overflow and use inode_newsize_ok() before extending the destination inode.
--- fs/f2fs/file.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
fs/f2fs/file.c +12 -4
@@ -3030,8 +3030,9 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,struct inode *src =file_inode (file_in);struct inode *dst =file_inode (file_out);struct f2fs_sb_info *sbi =F2FS_I_SB (src); -size_t olen = len, dst_max_i_size =0 ; -size_t dst_osize; +size_t olen = len; +loff_t dst_max_i_size =0 ; +loff_t dst_osize, dst_end;int ret; if (file_in->f_path.mnt != file_out->f_path.mnt ||
@@ -3088,8 +3089,15 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in, } dst_osize = dst->i_size; -if (pos_out + olen > dst->i_size) - dst_max_i_size = pos_out + olen; +if (olen >LLONG_MAX - pos_out) + goto out_unlock; + dst_end = pos_out + olen; +if (dst_end > dst->i_size) { + ret =inode_newsize_ok (dst, dst_end); +if (ret) + goto out_unlock; + dst_max_i_size = dst_end; + }/* verify the end result is block aligned */ if (!IS_ALIGNED(pos_in, F2FS_BLKSIZE) ||
Signature · 1 line
2.53.0