Linux EXT4 FS development
 help / color / mirror / Atom feed
* [PATCH] jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
@ 2026-05-12  7:49 Junrui Luo
  2026-05-12 12:08 ` Zhang Yi
  2026-05-13  9:28 ` [PATCH v2] " Junrui Luo
  0 siblings, 2 replies; 9+ messages in thread
From: Junrui Luo @ 2026-05-12  7:49 UTC (permalink / raw)
  To: Theodore Ts'o, Jan Kara, Harshad Shirwadkar
  Cc: linux-ext4, linux-kernel, Yuhao Jiang, stable, Junrui Luo

jbd2_journal_initialize_fast_commit() validates journal capacity by
checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS).
Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds
j_last the subtraction wraps to a large value, bypassing the bounds
check.

The resulting underflow corrupts j_last, j_fc_first, and j_free,
leading to journal abort.

Fix by adding an overflow guard that checks num_fc_blks against j_last
before performing the subtraction.

Fixes: 6866d7b3f2bb ("ext4 / jbd2: add fast commit initialization")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
---
 fs/jbd2/journal.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index cb2c529a8f1b..a54146576c3f 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -2263,7 +2263,8 @@ jbd2_journal_initialize_fast_commit(journal_t *journal)
 	unsigned long long num_fc_blks;
 
 	num_fc_blks = jbd2_journal_get_num_fc_blks(sb);
-	if (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS)
+	if (num_fc_blks > journal->j_last ||
+	    journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS)
 		return -ENOSPC;
 
 	/* Are we called twice? */

---
base-commit: 7aaa8047eafd0bd628065b15757d9b48c5f9c07d
change-id: 20260512-fixes-2ff4f9f7d064

Best regards,
-- 
Junrui Luo <moonafterrain@outlook.com>


^ permalink raw reply related	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2026-06-04 14:46 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-12  7:49 [PATCH] jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() Junrui Luo
2026-05-12 12:08 ` Zhang Yi
2026-05-12 13:03   ` Junrui Luo
2026-05-13  9:28 ` [PATCH v2] " Junrui Luo
2026-05-13  9:47   ` Jan Kara
2026-05-13 11:08   ` Zhang Yi
2026-06-01 10:06   ` Baokun Li
2026-06-01 11:37   ` Baokun Li
2026-06-04 14:45   ` Theodore Ts'o

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox