[lvc-project] [PATCH 5.10/5.15 0/2] ocfs2: backport orphan-slot validation fixes

[Mikhail Dmitrichenko]

Both orphan-slot fields are read from disk and later used to index
per-slot arrays. Reject out-of-range values during inode validation,
before orphan cleanup or recovery can use them.

Backport the original upstream series [1] to 5.10.y and 5.15.y:

  1. Validate i_orphaned_slot (CVE-2026-90205).
  2. Validate i_dio_orphaned_slot (CVE-2026-90204).

Both patches apply to v5.10.273 and v5.15.224. Built fs/ocfs2/inode.o
after each patch on both branches with GCC 13.3.0, without compiler
warnings. Runtime testing was not performed.

[1] https://lore.kernel.org/all/20260803030007.3993199-1-gality369@gmail.com/

ZhengYuan Huang (2):
  ocfs2: validate orphan slot during inode read
  ocfs2: validate DIO orphan slot during inode read

 fs/ocfs2/inode.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)