Re: [PATCH] ext4: validate inode block references during fast commit replay

[sashiko-bot@kernel.org]

> __ext4_iget() currently skips ext4_ext_check_inode() and
> ext4_ind_check_inode() when EXT4_FC_REPLAY is set in s_mount_state.
> As a result, an extent-mapped inode loaded from disk during fast commit
> replay never has its in-inode extent header or root extent entries
> validated before replay paths such as ext4_fc_replay_inode() and
> ext4_fc_replay_add_range() walk or modify i_data[].
> 
> A crafted filesystem image with a fast commit journal and an inode whose
> eh_max / eh_entries exceed the four-extent capacity of i_data[] triggers
> slab-out-of-bounds reads in ext4_cache_extents() and slab-out-of-bounds
> writes in ext4_ext_insert_extent() into adjacent fields of struct
> ext4_inode_info and beyond the ext4_inode_cache slab allocation.
> 
> ext4_ext_check_inode() and ext4_ind_check_inode() only validate the
> in-inode extent header and check block numbers against static superblock
> bounds via ext4_inode_block_valid(), not block allocation bitmaps. So,
> drop the EXT4_FC_REPLAY exemption in __ext4_iget() so inodes read during
> fast commit replay are validated.
> 
> Cc: stable@vger.kernel.org
> Reported-by: Simon Brakhane <simon@brakhane.net>
> Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
> Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026164853.3125835-1-hamzamahfooz@linux.microsoft.com?part=1