[PATCH 1/2] nsfs: fix u32-vs-bytes unit mismatch in nsfs_fh_to_dentry()
From: Hui Peng
Date: Sat Sep 19 2026 - 04:09:09 EST
In nsfs_fh_to_dentry(), both fh_len and NSFS_FID_SIZE_U32_LATEST (4) are
expressed in units of 4-byte u32 words rather than bytes, whereas
pointer arithmetic on (void *)fid and the byte count passed to
memchr_inv() are in bytes (NSFS_FILE_HANDLE_SIZE_LATEST = 16).
Passing (void *)fid + NSFS_FID_SIZE_U32_LATEST and
fh_len - NSFS_FID_SIZE_U32_LATEST to memchr_inv() inspects bytes
[4 .. fh_len) inside struct nsfs_file_handle (fid->ns_id and
fid->ns_type) instead of the trailing bytes [16 .. fh_len * 4) after
struct nsfs_file_handle. Consequently:
1. Valid zero-padded handles with handle_bytes >= 36 (fh_len >= 9) where
fid->ns_type != 0 (at byte offset 8) are falsely rejected with
-ESTALE.
2. Non-zero trailing garbage in bytes [16 .. fh_len * 4) is ignored when
the upper 32 bits of fid->ns_id (bytes [4..7]) are zero.
Fix this by offsetting (void *)fid by NSFS_FILE_HANDLE_SIZE_LATEST (16)
and multiplying (fh_len - NSFS_FID_SIZE_U32_LATEST) by sizeof(u32).
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
fs/nsfs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nsfs.c b/fs/nsfs.c
index c3b6ae765..a1842e12f 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -529,8 +529,8 @@
/* Check that any trailing bytes are zero. */
if ((fh_len > NSFS_FID_SIZE_U32_LATEST) &&
- memchr_inv((void *)fid + NSFS_FID_SIZE_U32_LATEST, 0,
- fh_len - NSFS_FID_SIZE_U32_LATEST))
+ memchr_inv((void *)fid + NSFS_FILE_HANDLE_SIZE_LATEST, 0,
+ (fh_len - NSFS_FID_SIZE_U32_LATEST) * sizeof(u32)))
return NULL;
switch (fh_type) {
--
2.43.0