[PATCH v3 6/9] ext4: improve EXT4_GET_BLOCKS_CACHED_NOWAIT handling in ext4_map_blocks

[Baokun Li <libaokun@linux.alibaba.com>]

When EXT4_GET_BLOCKS_CACHED_NOWAIT is set and the extent status cache
hits, ext4_map_blocks() returns immediately without running
check_block_validity(). This allows malicious extents from crafted
filesystem images to bypass validation if they have been cached by a
previous blocking read.

Make three improvements to the EXT4_GET_BLOCKS_CACHED_NOWAIT handling:

1. Change the cache-hit path from "return retval" to "goto found" so
   that check_block_validity() always runs, closing the security bypass.

2. Return -EAGAIN instead of 0 on cache miss to distinguish it from a
   cache hit on a hole or delayed extent (which returns 0). The only
   existing caller (ext4_get_link() -> ext4_getblk() -> ERR_PTR())
   converts both -EAGAIN and 0 to ERR_PTR(-ECHILD), so the end result
   is unchanged.

3. Add WARN_ON_ONCE after the EXT4_GET_BLOCKS_CREATE==0 early return
   to assert that EXT4_GET_BLOCKS_CREATE and EXT4_GET_BLOCKS_CACHED_NOWAIT
   are never combined, since EXT4_GET_BLOCKS_CREATE requires blocking on
   i_data_sem.

Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
---
 fs/ext4/inode.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 832794294ccf..7f9ae584ad98 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -759,8 +759,9 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
 			BUG();
 		}
 
+		/* Skip blocking operations and jump to extent validation. */
 		if (flags & EXT4_GET_BLOCKS_CACHED_NOWAIT)
-			return retval;
+			goto found;
 #ifdef ES_AGGRESSIVE_TEST
 		ext4_map_blocks_es_recheck(handle, inode, map,
 					   &orig_map, flags);
@@ -776,7 +777,7 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
 	 * cannot find extent in the cache.
 	 */
 	if (flags & EXT4_GET_BLOCKS_CACHED_NOWAIT)
-		return 0;
+		return -EAGAIN;
 
 	/*
 	 * Try to see if we can get the block without requesting a new
@@ -797,6 +798,9 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
 	if ((flags & EXT4_GET_BLOCKS_CREATE) == 0)
 		return retval;
 
+	/* EXT4_GET_BLOCKS_CREATE cannot operate in NOWAIT mode */
+	WARN_ON_ONCE(flags & EXT4_GET_BLOCKS_CACHED_NOWAIT);
+
 	/*
 	 * Returns if the blocks have already allocated
 	 *
-- 
2.43.7