From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7E742C0319; Mon, 14 Apr 2025 13:29:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744637396; cv=none; b=Eacb96X0YYZxZN2uYkxXYJIkZbI32YzQs/MlMTD4syBW/a5XZBA+OKtzuG1W4sBFkEz/nkvShFhFmXuiZw8dMuF+61xw4YfrAe5gjkuZWisDYI07X8waXAvjKEOQMJBi/4O2WXe1DXz3rqkUSW/+qjjhvqOraEzrThRcirnY5Iw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744637396; c=relaxed/simple; bh=/rAY3btrsoSQFDtZJbu9cArnT83eyjCjHHLhGgnTWjA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=BvZ6o8qBrKsxIdVadw+7DcnqjY/GsVbOwMhxhBA0oVYPdnD3OX4k4zQZdzYViTXQa5gTniKUKhRtldirTvCSSme0B0SCFK9GB5ElHEhZjbkjwzdJckoepu9TA2VmEcYu90LfXXt8U7zedtARConjv01YLMnFnqxACpWQ4UP7u9k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=jFT8Umo7; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="jFT8Umo7" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 30F58C4CEE2; Mon, 14 Apr 2025 13:29:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1744637396; bh=/rAY3btrsoSQFDtZJbu9cArnT83eyjCjHHLhGgnTWjA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jFT8Umo7WPLYSzVivu6o6qGNGmWlHYCW0R3Wtk+r0lMwLpAyF7VHCPeuIe+LJkAUo 5tsDl9ULqnuHTwQlNqpVEr971ya+9VytHt1r+tVRISleNC7XmTkgkugYfmRzUDzHL4 9pKIHrF6x+G3UMYy/xoPA9+k7Zu3hIlo1389IC0+LXsIdbzci74vA3gJ9XiAIMzzx9 RoUfrLpJtr3o0yEAmYXESAU23La5bwAcZoYD5RJPs2fVu7b7mcJ+Ba78fFFeWIpzHK jzKV13Tq15TehwMWpTpLw/HzEyoe3auLagw02tMyxvPrMLKbYYPKGlrAH2+8qjrRSs VJkrGNIV3FbcA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ojaswin Mujoo , Baokun Li , Jan Kara , Zhang Yi , Theodore Ts'o , Sasha Levin , adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org Subject: [PATCH AUTOSEL 6.12 30/30] ext4: make block validity check resistent to sb bh corruption Date: Mon, 14 Apr 2025 09:28:47 -0400 Message-Id: <20250414132848.679855-30-sashal@kernel.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250414132848.679855-1-sashal@kernel.org> References: <20250414132848.679855-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-ext4@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.12.23 Content-Transfer-Encoding: 8bit From: Ojaswin Mujoo [ Upstream commit ccad447a3d331a239477c281533bacb585b54a98 ] Block validity checks need to be skipped in case they are called for journal blocks since they are part of system's protected zone. Currently, this is done by checking inode->ino against sbi->s_es->s_journal_inum, which is a direct read from the ext4 sb buffer head. If someone modifies this underneath us then the s_journal_inum field might get corrupted. To prevent against this, change the check to directly compare the inode with journal->j_inode. **Slight change in behavior**: During journal init path, check_block_validity etc might be called for journal inode when sbi->s_journal is not set yet. In this case we now proceed with ext4_inode_block_valid() instead of returning early. Since systems zones have not been set yet, it is okay to proceed so we can perform basic checks on the blocks. Suggested-by: Baokun Li Reviewed-by: Baokun Li Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Signed-off-by: Ojaswin Mujoo Link: https://patch.msgid.link/0c06bc9ebfcd6ccfed84a36e79147bf45ff5adc1.1743142920.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin --- fs/ext4/block_validity.c | 5 ++--- fs/ext4/inode.c | 7 ++++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c index 87ee3a17bd29c..e8c5525afc67a 100644 --- a/fs/ext4/block_validity.c +++ b/fs/ext4/block_validity.c @@ -351,10 +351,9 @@ int ext4_check_blockref(const char *function, unsigned int line, { __le32 *bref = p; unsigned int blk; + journal_t *journal = EXT4_SB(inode->i_sb)->s_journal; - if (ext4_has_feature_journal(inode->i_sb) && - (inode->i_ino == - le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) + if (journal && inode == journal->j_inode) return 0; while (bref < p+max) { diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 67a5b937f5a92..977bd92c77108 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -383,10 +383,11 @@ static int __check_block_validity(struct inode *inode, const char *func, unsigned int line, struct ext4_map_blocks *map) { - if (ext4_has_feature_journal(inode->i_sb) && - (inode->i_ino == - le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) + journal_t *journal = EXT4_SB(inode->i_sb)->s_journal; + + if (journal && inode == journal->j_inode) return 0; + if (!ext4_inode_block_valid(inode, map->m_pblk, map->m_len)) { ext4_error_inode(inode, func, line, map->m_pblk, "lblock %lu mapped to illegal pblock %llu " -- 2.39.5