Re: [PATCH] ext4: fix OOB memmove in ext4_xattr_set_entry

[sashiko-bot@kernel.org]

> A corrupted filesystem can leave an inode marked as having inline data
> while the system.data xattr is missing. ext4_destroy_inline_data_nolock()
> then asks ext4_xattr_set_entry() to remove an entry even though
> ext4_xattr_ibody_find() left the search state at the insertion position.
> 
> In the syzkaller reproducer, the old xattr value offset is smaller than
> min_offs. ext4_xattr_set_entry() then computes val - first_val for
> memmove(), the length wraps to a huge size_t, and memmove() can run out of
> the xattr buffer. This results in an out-of-bounds memmove and a kernel
> page fault.
> 
> A crafted corrupted ext4 image can trigger this while inline data is being
> converted out of the inode. Treat the inconsistent inline/xattr state as
> filesystem corruption before updating the xattr entry.
> 
> [ ... ]
> 120 seconds without triggering KASAN, Oops, a memmove fault, or panic.
> 
> Fixes: 67cf5b09a46f ("ext4: add the basic function for inline data support")
> Cc: stable@vger.kernel.org # v3.8+
> Signed-off-by: Zhao Gongyi <zhaogongyi@bytedance.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918101249.43643-1-zhaogongyi@bytedance.com?part=1