[PATCH 3/5] ubifs: reject master nodes claiming a too small inode number

[Zhihao Cheng]

在 2026/11/2 21:49, shao.mingyin at zte.com.cn 写道:
> validate_master() only rejects highest_inum values above
> INUM_WATERMARK.  A master node whose value is below UBIFS_FIRST_INO is
> accepted, and ubifs_new_inode() then allocates inode numbers starting
> from that value, i.e. from the range reserved for special inodes.  With
> highest_inum = 0 the very first new inode gets number 1, which is
> UBIFS_ROOT_INO and is already used by the root inode, so two inodes end
> up with the same number and the index is corrupted.
> 
> Check the lower bound as well.
> 
> Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
> Cc: stable at vger.kernel.org
> Signed-off-by: Shao Mingyin <shao.mingyin at zte.com.cn>
> ---
> diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c
> index a148760fa49e..8a1ba81c10bb 100644
> --- a/fs/ubifs/master.c
> +++ b/fs/ubifs/master.c
> @@ -191,6 +191,16 @@ static int validate_master(const struct ubifs_info *c)
>   		goto out;
>   	}
>   
> +	/*
> +	 * Inode numbers below UBIFS_FIRST_INO are reserved.  If the master
> +	 * node claims a smaller value, newly created inodes would reuse the
> +	 * root inode number or another reserved one.
> +	 */
> +	if (c->highest_inum < UBIFS_FIRST_INO) {
> +		err = 24;
> +		goto out;
> +	}
> +

This check could be merged into previous check:
  f (c->highest_inum >= INUM_WATERMARK)
>   	if (c->lhead_lnum < UBIFS_LOG_LNUM ||
>   	    c->lhead_lnum >= UBIFS_LOG_LNUM + c->log_lebs ||
>   	    c->lhead_offs < 0 || c->lhead_offs >= c->leb_size ||
> .
>