* Forwarded: [PATCH] ext4: Fix extent boundary validation in extent tree
2025-09-04 9:44 [syzbot] [ext4?] kernel BUG in ext4_es_cache_extent (3) syzbot
@ 2025-09-28 7:45 ` syzbot
2025-09-28 9:11 ` Forwarded: [PATCH] ext4: fix BUG_ON in ext4_es_cache_extent due to out-of-order extents syzbot
` (6 subsequent siblings)
7 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2025-09-28 7:45 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: Fix extent boundary validation in extent tree
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
This patch addresses a vulnerability in EXT4 extent tree validation
where logically impossible extent entries could be created. The fix
prevents extent entries with an end block less than the start block.
Key changes:
- Add boundary checks to validate extent entries
- Prevent creation of extents with invalid block ranges
- Improve extent tree integrity checks
The bug was discovered via syzkaller, which generated a test case
exposing this boundary condition vulnerability during filesystem
metadata parsing.
Fixes: https://syzkaller.appspot.com/bug?extid=038b7bf43423e132b308
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/extents.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index ca5499e9412b..987a07a8554e 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -418,6 +418,10 @@ static int ext4_valid_extent_entries(struct inode *inode,
/* Check for overlapping extents */
lblock = le32_to_cpu(ext->ee_block);
+ ext4_lblk_t len = ext4_ext_get_actual_len(ext);
+ ext4_lblk_t end = lblock + len - 1;
+ if (end < lblock)
+ return 0;
if (lblock < cur) {
*pblk = ext4_ext_pblock(ext);
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* Forwarded: [PATCH] ext4: fix BUG_ON in ext4_es_cache_extent due to out-of-order extents
2025-09-04 9:44 [syzbot] [ext4?] kernel BUG in ext4_es_cache_extent (3) syzbot
2025-09-28 7:45 ` Forwarded: [PATCH] ext4: Fix extent boundary validation in extent tree syzbot
@ 2025-09-28 9:11 ` syzbot
2025-09-28 9:11 ` syzbot
` (5 subsequent siblings)
7 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2025-09-28 9:11 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: fix BUG_ON in ext4_es_cache_extent due to out-of-order extents
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
syzbot reported a BUG_ON in ext4_es_cache_extent() triggered when
opening a verity file on a corrupted ext4 filesystem mounted without
a journal.
The issue occurs when the extent tree contains out-of-order extents,
which can happen in a corrupted filesystem. In ext4_cache_extents(),
when processing an extent that has a lower logical block number than
the previous extent's end, the calculation of the hole size underflows:
If prev = 4352 and lblk = 1280:
lblk - prev = 1280 - 4352 = -3072 (as signed)
= 4294964224 (as unsigned)
This underflowed value is passed as 'len' to ext4_es_cache_extent(),
where the end block calculation overflows:
end = lblk + len - 1 = 4352 + 4294964224 - 1 = 1279
Then the BUG_ON(end < lblk) triggers because 1279 < 4352.
Fix this by adding a check in ext4_cache_extents() to ensure extents
are properly ordered before attempting to cache holes. If out-of-order
extents are detected, report the filesystem corruption and return.
Reported-by: syzbot+038b7bf43423e132b308@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=038b7bf43423e132b308
Fixes: a86c6181109a ("ext4: cache extent hole in extent status tree for ext4_da_map_blocks()")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
---
fs/ext4/extents.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index ca5499e9412b..2e630b500a31 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -535,10 +535,17 @@ static void ext4_cache_extents(struct inode *inode,
ext4_lblk_t lblk = le32_to_cpu(ex->ee_block);
int len = ext4_ext_get_actual_len(ex);
- if (prev && (prev != lblk))
- ext4_es_cache_extent(inode, prev, lblk - prev, ~0,
- EXTENT_STATUS_HOLE);
-
+ if (prev && (prev != lblk)) {
+ if (lblk > prev) {
+ ext4_es_cache_extent(inode, prev, lblk - prev, ~0,
+ EXTENT_STATUS_HOLE);
+ } else {
+ /* Extents out of order - corrupted? */
+ EXT4_ERROR_INODE(inode, "corrupted extent tree: lblk %u < prev %u",
+ lblk, prev);
+ return;
+ }
+ }
if (ext4_ext_is_unwritten(ex))
status = EXTENT_STATUS_UNWRITTEN;
ext4_es_cache_extent(inode, lblk, len,
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* Forwarded: [PATCH] ext4: fix BUG_ON in ext4_es_cache_extent due to out-of-order extents
2025-09-04 9:44 [syzbot] [ext4?] kernel BUG in ext4_es_cache_extent (3) syzbot
2025-09-28 7:45 ` Forwarded: [PATCH] ext4: Fix extent boundary validation in extent tree syzbot
2025-09-28 9:11 ` Forwarded: [PATCH] ext4: fix BUG_ON in ext4_es_cache_extent due to out-of-order extents syzbot
@ 2025-09-28 9:11 ` syzbot
2025-09-28 9:41 ` Forwarded: [PATCH] ext4: validate extent entries before caching in ext4_find_extent() syzbot
` (4 subsequent siblings)
7 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2025-09-28 9:11 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: fix BUG_ON in ext4_es_cache_extent due to out-of-order extents
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
syzbot reported a BUG_ON in ext4_es_cache_extent() triggered when
opening a verity file on a corrupted ext4 filesystem mounted without
a journal.
The issue occurs when the extent tree contains out-of-order extents,
which can happen in a corrupted filesystem. In ext4_cache_extents(),
when processing an extent that has a lower logical block number than
the previous extent's end, the calculation of the hole size underflows:
If prev = 4352 and lblk = 1280:
lblk - prev = 1280 - 4352 = -3072 (as signed)
= 4294964224 (as unsigned)
This underflowed value is passed as 'len' to ext4_es_cache_extent(),
where the end block calculation overflows:
end = lblk + len - 1 = 4352 + 4294964224 - 1 = 1279
Then the BUG_ON(end < lblk) triggers because 1279 < 4352.
Fix this by adding a check in ext4_cache_extents() to ensure extents
are properly ordered before attempting to cache holes. If out-of-order
extents are detected, report the filesystem corruption and return.
Reported-by: syzbot+038b7bf43423e132b308@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=038b7bf43423e132b308
Fixes: a86c6181109a ("ext4: cache extent hole in extent status tree for ext4_da_map_blocks()")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
---
fs/ext4/extents.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index ca5499e9412b..2e630b500a31 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -535,10 +535,17 @@ static void ext4_cache_extents(struct inode *inode,
ext4_lblk_t lblk = le32_to_cpu(ex->ee_block);
int len = ext4_ext_get_actual_len(ex);
- if (prev && (prev != lblk))
- ext4_es_cache_extent(inode, prev, lblk - prev, ~0,
- EXTENT_STATUS_HOLE);
-
+ if (prev && (prev != lblk)) {
+ if (lblk > prev) {
+ ext4_es_cache_extent(inode, prev, lblk - prev, ~0,
+ EXTENT_STATUS_HOLE);
+ } else {
+ /* Extents out of order - corrupted? */
+ EXT4_ERROR_INODE(inode, "corrupted extent tree: lblk %u < prev %u",
+ lblk, prev);
+ return;
+ }
+ }
if (ext4_ext_is_unwritten(ex))
status = EXTENT_STATUS_UNWRITTEN;
ext4_es_cache_extent(inode, lblk, len,
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* Forwarded: [PATCH] ext4: validate extent entries before caching in ext4_find_extent()
2025-09-04 9:44 [syzbot] [ext4?] kernel BUG in ext4_es_cache_extent (3) syzbot
` (2 preceding siblings ...)
2025-09-28 9:11 ` syzbot
@ 2025-09-28 9:41 ` syzbot
2025-09-28 9:41 ` syzbot
` (3 subsequent siblings)
7 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2025-09-28 9:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: validate extent entries before caching in ext4_find_extent()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
syzbot reported a BUG_ON in ext4_es_cache_extent() triggered when
opening a verity file on a corrupted ext4 filesystem mounted without
a journal.
The issue occurs when the extent tree contains out-of-order extents,
which can happen in a corrupted filesystem. ext4_find_extent() calls
ext4_cache_extents() without validating the extent entries when the
tree depth is 0 (leaf level). This allows corrupted extent trees with
out-of-order extents to be cached, triggering a BUG_ON in
ext4_es_cache_extent() due to integer underflow when calculating hole
sizes:
If prev = 4352 and lblk = 1280:
lblk - prev = 1280 - 4352 = -3072 (as signed)
= 4294964224 (as unsigned)
end = lblk + len - 1 = 4352 + 4294964224 - 1 = 1279 (after overflow)
BUG_ON(end < lblk) triggers because 1279 < 4352
Fix this by adding extent entry validation using the existing
ext4_valid_extent_entries() function before caching. This ensures
corrupted extent trees are detected and handled properly through the
error path, preventing both the BUG_ON and potential use-after-free
issues.
Reported-by: syzbot+038b7bf43423e132b308@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=038b7bf43423e132b308
Fixes: a86c6181109a ("ext4: cache extent hole in extent status tree for ext4_da_map_blocks()")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/extents.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index ca5499e9412b..f8e45623f7ea 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -924,8 +924,18 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block,
path[0].p_bh = NULL;
i = depth;
- if (!(flags & EXT4_EX_NOCACHE) && depth == 0)
+ if (!(flags & EXT4_EX_NOCACHE) && depth == 0) {
+ ext4_fsblk_t pblk = 0;
+
+ if (!ext4_valid_extent_entries(inode, eh, 0, &pblk, 0)) {
+ EXT4_ERROR_INODE(inode,
+ "invalid extent entries, pblk %llu",
+ pblk);
+ ret = -EFSCORRUPTED;
+ goto err;
+ }
ext4_cache_extents(inode, eh);
+ }
/* walk through the tree */
while (i) {
ext_debug(inode, "depth %d: num %d, max %d\n",
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* Forwarded: [PATCH] ext4: validate extent entries before caching in ext4_find_extent()
2025-09-04 9:44 [syzbot] [ext4?] kernel BUG in ext4_es_cache_extent (3) syzbot
` (3 preceding siblings ...)
2025-09-28 9:41 ` Forwarded: [PATCH] ext4: validate extent entries before caching in ext4_find_extent() syzbot
@ 2025-09-28 9:41 ` syzbot
2025-09-29 14:40 ` Forwarded: [PATCH v2] ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot
` (2 subsequent siblings)
7 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2025-09-28 9:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: validate extent entries before caching in ext4_find_extent()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
syzbot reported a BUG_ON in ext4_es_cache_extent() triggered when
opening a verity file on a corrupted ext4 filesystem mounted without
a journal.
The issue occurs when the extent tree contains out-of-order extents,
which can happen in a corrupted filesystem. ext4_find_extent() calls
ext4_cache_extents() without validating the extent entries when the
tree depth is 0 (leaf level). This allows corrupted extent trees with
out-of-order extents to be cached, triggering a BUG_ON in
ext4_es_cache_extent() due to integer underflow when calculating hole
sizes:
If prev = 4352 and lblk = 1280:
lblk - prev = 1280 - 4352 = -3072 (as signed)
= 4294964224 (as unsigned)
end = lblk + len - 1 = 4352 + 4294964224 - 1 = 1279 (after overflow)
BUG_ON(end < lblk) triggers because 1279 < 4352
Fix this by adding extent entry validation using the existing
ext4_valid_extent_entries() function before caching. This ensures
corrupted extent trees are detected and handled properly through the
error path, preventing both the BUG_ON and potential use-after-free
issues.
Reported-by: syzbot+038b7bf43423e132b308@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=038b7bf43423e132b308
Fixes: a86c6181109a ("ext4: cache extent hole in extent status tree for ext4_da_map_blocks()")
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/extents.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index ca5499e9412b..f8e45623f7ea 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -924,8 +924,18 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block,
path[0].p_bh = NULL;
i = depth;
- if (!(flags & EXT4_EX_NOCACHE) && depth == 0)
+ if (!(flags & EXT4_EX_NOCACHE) && depth == 0) {
+ ext4_fsblk_t pblk = 0;
+
+ if (!ext4_valid_extent_entries(inode, eh, 0, &pblk, 0)) {
+ EXT4_ERROR_INODE(inode,
+ "invalid extent entries, pblk %llu",
+ pblk);
+ ret = -EFSCORRUPTED;
+ goto err;
+ }
ext4_cache_extents(inode, eh);
+ }
/* walk through the tree */
while (i) {
ext_debug(inode, "depth %d: num %d, max %d\n",
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* Forwarded: [PATCH v2] ext4: detect invalid INLINE_DATA + EXTENTS flag combination
2025-09-04 9:44 [syzbot] [ext4?] kernel BUG in ext4_es_cache_extent (3) syzbot
` (4 preceding siblings ...)
2025-09-28 9:41 ` syzbot
@ 2025-09-29 14:40 ` syzbot
2025-09-30 9:16 ` Forwarded: [PATCH v3] " syzbot
2025-09-30 10:45 ` Forwarded: [PATCH v4] " syzbot
7 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2025-09-29 14:40 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH v2] ext4: detect invalid INLINE_DATA + EXTENTS flag combination
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity
file on a corrupted ext4 filesystem mounted without a journal.
The issue is that the filesystem has an inode with both the INLINE_DATA
and EXTENTS flags set:
EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15:
comm syz.0.17: corrupted extent tree: lblk 0 < prev 66
Investigation revealed that the inode has both flags set:
DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1
This is an invalid combination since an inode should have either:
- INLINE_DATA: data stored directly in the inode
- EXTENTS: data stored in extent-mapped blocks
Having both flags causes ext4_has_inline_data() to return true, skipping
extent tree validation in __ext4_iget(). The unvalidated out-of-order
extents then trigger a BUG_ON in ext4_es_cache_extent() due to integer
underflow when calculating hole sizes.
Fix this by detecting this invalid flag combination early in ext4_iget()
and rejecting the corrupted inode.
Reported-by: syzbot+038b7bf43423e132b308@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=038b7bf43423e132b308
Suggested-by: Zhang Yi <yi.zhang@huawei.com>
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
Changes in v2:
- Instead of adding validation in ext4_find_extent(), detect the invalid
INLINE_DATA + EXTENTS flag combination in ext4_iget() as suggested by
Zhang Yi to avoid redundant checks in the extent lookup path
fs/ext4/inode.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..71fa3faa1475 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5445,6 +5445,15 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
}
ret = 0;
+ /* Detect invalid flag combination - can't have both inline data and extents */
+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA) &&
+ ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
+ ext4_error_inode(inode, __func__, __LINE__, 0,
+ "inode has both inline data and extents flags");
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+ }
+
if (ei->i_file_acl &&
!ext4_inode_block_valid(inode, ei->i_file_acl, 1)) {
ext4_error_inode(inode, function, line, 0,
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* Forwarded: [PATCH v3] ext4: detect invalid INLINE_DATA + EXTENTS flag combination
2025-09-04 9:44 [syzbot] [ext4?] kernel BUG in ext4_es_cache_extent (3) syzbot
` (5 preceding siblings ...)
2025-09-29 14:40 ` Forwarded: [PATCH v2] ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot
@ 2025-09-30 9:16 ` syzbot
2025-09-30 10:45 ` Forwarded: [PATCH v4] " syzbot
7 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2025-09-30 9:16 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH v3] ext4: detect invalid INLINE_DATA + EXTENTS flag combination
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity
file on a corrupted ext4 filesystem mounted without a journal.
The issue is that the filesystem has an inode with both the INLINE_DATA
and EXTENTS flags set:
EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15:
comm syz.0.17: corrupted extent tree: lblk 0 < prev 66
Investigation revealed that the inode has both flags set:
DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1
This is an invalid combination since an inode should have either:
- INLINE_DATA: data stored directly in the inode
- EXTENTS: data stored in extent-mapped blocks
Having both flags causes ext4_has_inline_data() to return true, skipping
extent tree validation in __ext4_iget(). The unvalidated out-of-order
extents then trigger a BUG_ON in ext4_es_cache_extent() due to integer
underflow when calculating hole sizes.
Fix this by detecting this invalid flag combination early in ext4_iget()
and rejecting the corrupted inode.
Reported-and-tested-by: syzbot+038b7bf43423e132b308@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=038b7bf43423e132b308
Suggested-by: Zhang Yi <yi.zhang@huawei.com>
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
Changes in v3:
- Fix code alignment and use existing function/line variables per Zhang Yi
- Keep check after ret = 0 where all inode fields are initialized, as
i_inline_off gets set during inode initialization after ext4_set_inode_flags()
Changes in v2:
- Instead of adding validation in ext4_find_extent(), detect the invalid
INLINE_DATA + EXTENTS flag combination in ext4_iget() as suggested by
Zhang Yi to avoid redundant checks in the extent lookup path
---
fs/ext4/inode.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..5c97de5775c7 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5445,6 +5445,15 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
}
ret = 0;
+ /* Detect invalid flag combination - can't have both inline data and extents */
+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA) &&
+ ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
+ ext4_error_inode(inode, function, line, 0,
+ "inode has both inline data and extents flags");
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+ }
+
if (ei->i_file_acl &&
!ext4_inode_block_valid(inode, ei->i_file_acl, 1)) {
ext4_error_inode(inode, function, line, 0,
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* Forwarded: [PATCH v4] ext4: detect invalid INLINE_DATA + EXTENTS flag combination
2025-09-04 9:44 [syzbot] [ext4?] kernel BUG in ext4_es_cache_extent (3) syzbot
` (6 preceding siblings ...)
2025-09-30 9:16 ` Forwarded: [PATCH v3] " syzbot
@ 2025-09-30 10:45 ` syzbot
7 siblings, 0 replies; 15+ messages in thread
From: syzbot @ 2025-09-30 10:45 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH v4] ext4: detect invalid INLINE_DATA + EXTENTS flag combination
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity
file on a corrupted ext4 filesystem mounted without a journal.
The issue is that the filesystem has an inode with both the INLINE_DATA
and EXTENTS flags set:
EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15:
comm syz.0.17: corrupted extent tree: lblk 0 < prev 66
Investigation revealed that the inode has both flags set:
DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1
This is an invalid combination since an inode should have either:
- INLINE_DATA: data stored directly in the inode
- EXTENTS: data stored in extent-mapped blocks
Having both flags causes ext4_has_inline_data() to return true, skipping
extent tree validation in __ext4_iget(). The unvalidated out-of-order
extents then trigger a BUG_ON in ext4_es_cache_extent() due to integer
underflow when calculating hole sizes.
Fix this by detecting this invalid flag combination early in ext4_iget()
and rejecting the corrupted inode.
Reported-and-tested-by: syzbot+038b7bf43423e132b308@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=038b7bf43423e132b308
Suggested-by: Zhang Yi <yi.zhang@huawei.com>
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
Changes in v4:
- Move check to right after ext4_set_inode_flags() as suggested by Zhang Yi,
since we're checking flags directly (not ext4_has_inline_data() return value)
Changes in v3:
- Fix code alignment and use existing function/line variables per Zhang Yi
Changes in v2:
- Instead of adding validation in ext4_find_extent(), detect the invalid
INLINE_DATA + EXTENTS flag combination in ext4_iget() as suggested by
Zhang Yi to avoid redundant checks in the extent lookup path
---
fs/ext4/inode.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..2fef378dbc97 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5348,6 +5348,14 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
}
ei->i_flags = le32_to_cpu(raw_inode->i_flags);
ext4_set_inode_flags(inode, true);
+ /* Detect invalid flag combination - can't have both inline data and extents */
+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA) &&
+ ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
+ ext4_error_inode(inode, function, line, 0,
+ "inode has both inline data and extents flags");
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+ }
inode->i_blocks = ext4_inode_blocks(raw_inode, ei);
ei->i_file_acl = le32_to_cpu(raw_inode->i_file_acl_lo);
if (ext4_has_feature_64bit(sb))
--
2.43.0
^ permalink raw reply related [flat|nested] 15+ messages in thread