Patch "nilfs2: fix potential oob read in nilfs_btree_check_delete()" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    nilfs2: fix potential oob read in nilfs_btree_check_delete()

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     nilfs2-fix-potential-oob-read-in-nilfs_btree_check_d.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 8f871df438266dd86fdcad6e6f2c1682d8284e44
Author: Ryusuke Konishi <konishi.ryusuke@xxxxxxxxx>
Date:   Wed Sep 4 17:13:09 2024 +0900

    nilfs2: fix potential oob read in nilfs_btree_check_delete()
    
    [ Upstream commit f9c96351aa6718b42a9f42eaf7adce0356bdb5e8 ]
    
    The function nilfs_btree_check_delete(), which checks whether degeneration
    to direct mapping occurs before deleting a b-tree entry, causes memory
    access outside the block buffer when retrieving the maximum key if the
    root node has no entries.
    
    This does not usually happen because b-tree mappings with 0 child nodes
    are never created by mkfs.nilfs2 or nilfs2 itself.  However, it can happen
    if the b-tree root node read from a device is configured that way, so fix
    this potential issue by adding a check for that case.
    
    Link: https://lkml.kernel.org/r/20240904081401.16682-4-konishi.ryusuke@xxxxxxxxx
    Fixes: 17c76b0104e4 ("nilfs2: B-tree based block mapping")
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke@xxxxxxxxx>
    Cc: Lizhi Xu <lizhi.xu@xxxxxxxxxxxxx>
    Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
index 7cfff27b4b4a5..7c9f4d79bdbc5 100644
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -1660,13 +1660,16 @@ static int nilfs_btree_check_delete(struct nilfs_bmap *btree, __u64 key)
 	int nchildren, ret;
 
 	root = nilfs_btree_get_root(btree);
+	nchildren = nilfs_btree_node_get_nchildren(root);
+	if (unlikely(nchildren == 0))
+		return 0;
+
 	switch (nilfs_btree_height(btree)) {
 	case 2:
 		bh = NULL;
 		node = root;
 		break;
 	case 3:
-		nchildren = nilfs_btree_node_get_nchildren(root);
 		if (nchildren > 1)
 			return 0;
 		ptr = nilfs_btree_node_get_ptr(root, nchildren - 1,
@@ -1675,12 +1678,12 @@ static int nilfs_btree_check_delete(struct nilfs_bmap *btree, __u64 key)
 		if (ret < 0)
 			return ret;
 		node = (struct nilfs_btree_node *)bh->b_data;
+		nchildren = nilfs_btree_node_get_nchildren(node);
 		break;
 	default:
 		return 0;
 	}
 
-	nchildren = nilfs_btree_node_get_nchildren(node);
 	maxkey = nilfs_btree_node_get_key(node, nchildren - 1);
 	nextmaxkey = (nchildren > 1) ?
 		nilfs_btree_node_get_key(node, nchildren - 2) : 0;