f2fs InlineDentry OOB

Vulnerability analysis

When converting inline directory entries to regular dentry blocks, the f2fs filesystem copies filename data from the inline storage area using a length read directly from the on-disk image without first checking that the filename fits within the available inline storage. A crafted f2fs image can therefore cause the kernel to read past the end of the inline filename storage, leaking adjacent kernel memory into the newly built dentry block and potentially crashing the system if the overread crosses a page boundary into unmapped memory. The fix adds a bounds check that validates each inline entry's name length against the available space, rejecting oversized entries before any data is copied. The vulnerable path is reached when mounting an f2fs filesystem image, which requires root-level privileges in the initial namespace or physical access to removable media that triggers an automount.