Re: [PATCH] ext4: reject impossible group free cluster counts

["Zhao Gongyi" <zhaogongyi@bytedance.com>]

Hi Andreas,

Thanks for the review.

On 11/3/26 6:10 AM, Andreas Dilger wrote:
> 
> I think a lot of this class of bug could be avoided by doing very minimal
> checks on the group descriptors initially (and other metadata, enough to
> load and validate the journal inode itself is sane). The journal inode is
> otherwise read-only so its allocations should never be modified.  Then
> replaying the journal if it is dirty, and restarting the superblock/GDT
> checks from the beginning to validate the _current_ blocks are sane.
> 
> That should only be done once per mount. To keep sanity after checks, we
> could validate the journal never contains updates to its own inode (or at
> least not until an SMR "wandering journal/log structure" feature exists).

Agreed. The post-recovery check in v1 is too narrow: it uses the live
superblock geometry, which journal replay may also have changed, and
leaves the other replayed group descriptor fields unchecked.

I will rework v2 so that only the checks needed to safely load the
journal are done before recovery, followed by full superblock geometry
and group descriptor validation after replay and before free-space
accounting. I will also check which existing validation helpers can be
safely rerun without duplicating initialization side effects.

Validating that the journal does not update its own inode also sounds
useful. If that requires broader journal changes, I will handle it
separately.

Thanks,
Gongyi