[PATCH] ext4: bail out when EXT4_INLINE_DATA_FL lacks system.data xattr

[PATCH] ext4: bail out when EXT4_INLINE_DATA_FL lacks system.data xattr

[Moon Hee Lee]

A syzbot-generated disk image triggered a BUG_ON in
ext4_update_inline_data() when an inode had the EXT4_INLINE_DATA_FL flag
set but lacked the required system.data extended attribute.

ext4_prepare_inline_data() now checks for the presence of this xattr and
returns -EFSCORRUPTED if it is missing. This prevents corrupted inodes
from reaching the update path and causing a crash.

[1] Syzbot crash log:

  EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
  fscrypt: AES-256-XTS using implementation "xts-aes-aesni-avx"
  loop0: detected capacity change from 512 to 64
  ------------[ cut here ]------------
  kernel BUG at fs/ext4/inline.c:357!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  CPU: 0 UID: 0 PID: 5499 Comm: syz.0.16 Not tainted 6.16.0-rc4-syzkaller-00348-g772b78c2abd8 #0 PREEMPT(full)
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
  RIP: 0010:ext4_update_inline_data+0x4e8/0x4f0 fs/ext4/inline.c:357
  Code: ...
  Call Trace:
   <TASK>
   ext4_prepare_inline_data+0x141/0x1d0 fs/ext4/inline.c:415
   ext4_generic_write_inline_data+0x207/0xc90 fs/ext4/inline.c:692
   ext4_try_to_write_inline_data+0x80/0xa0 fs/ext4/inline.c:763
   ext4_write_begin+0x2d8/0x1680 fs/ext4/inode.c:1281
   generic_perform_write+0x2c7/0x910 mm/filemap.c:4112
   ext4_buffered_write_iter+0xce/0x3a0 fs/ext4/file.c:299
   ext4_file_write_iter+0x298/0x1bc0 fs/ext4/file.c:-1
   new_sync_write fs/read_write.c:593 [inline]
   vfs_write+0x548/0xa90 fs/read_write.c:686
   ksys_write+0x145/0x250 fs/read_write.c:738
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
  RIP: ...
   </TASK>

[2] Reproducer image:
  https://storage.googleapis.com/syzbot-assets/f97118969515/mount_0.gz

[3] e2fsck output on the provided image:

  $ e2fsck -fn mount_0
    e2fsck 1.47.0 (5-Feb-2023)
    One or more block group descriptor checksums are invalid.  Fix? no

    Group descriptor 0 checksum is 0x8245, should be 0x353a.  IGNORED.
    Pass 1: Checking inodes, blocks, and sizes
    Inode 12 has INLINE_DATA_FL flag but extended attribute not found.  Truncate? no
    Inode 16, i_blocks is 3298534883346, should be 18.  Fix? no
    Inode 17, i_blocks is 17592186044416, should be 0.  Fix? no

    Pass 2: Checking directory structure
    Symlink /file0/file1 (inode #14) is invalid.
    Clear? no

    Entry 'file1' in /file0 (12) has an incorrect filetype (was 7, should be 0).
    Fix? no

    Directory inode 11, block #5, offset 0: directory corrupted
    Salvage? no

    e2fsck: aborted
    syzkaller: ********** WARNING: Filesystem still has errors **********

Reported-by: syzbot+544248a761451c0df72f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=544248a761451c0df72f
Fixes: 67cf5b09a46f ("ext4: add the basic function for inline data support")
Tested-by: syzbot+544248a761451c0df72f@syzkaller.appspotmail.com
Signed-off-by: Moon Hee Lee <moonhee.lee.ca@gmail.com>
---
 fs/ext4/inline.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index a1bbcdf40824..d9dcb0b09e5c 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -399,6 +399,13 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode,
 static int ext4_prepare_inline_data(handle_t *handle, struct inode *inode,
 				    loff_t len)
 {
+	struct ext4_xattr_ibody_find is = {
+		.s = { .not_found = -ENODATA, },
+	};
+	struct ext4_xattr_info i = {
+		.name_index = EXT4_XATTR_INDEX_SYSTEM,
+		.name = EXT4_XATTR_SYSTEM_DATA,
+	};
 	int ret, size, no_expand;
 	struct ext4_inode_info *ei = EXT4_I(inode);
 
@@ -409,6 +416,19 @@ static int ext4_prepare_inline_data(handle_t *handle, struct inode *inode,
 	if (size < len)
 		return -ENOSPC;
 
+	ret = ext4_get_inode_loc(inode, &is.iloc);
+	if (ret)
+		goto out;
+
+	ret = ext4_xattr_ibody_find(inode, &i, &is);
+	if (ret)
+		goto out;
+
+	if (is.s.not_found) {
+		ret = -EFSCORRUPTED;
+		goto out;
+	}
+
 	ext4_write_lock_xattr(inode, &no_expand);
 
 	if (ei->i_inline_off)
@@ -417,6 +437,8 @@ static int ext4_prepare_inline_data(handle_t *handle, struct inode *inode,
 		ret = ext4_create_inline_data(handle, inode, len);
 
 	ext4_write_unlock_xattr(inode, &no_expand);
+out:
+	brelse(is.iloc.bh);
 	return ret;
 }
 
-- 
2.43.0

Re: [PATCH] ext4: bail out when EXT4_INLINE_DATA_FL lacks system.data xattr

[kernel test robot]

Hello,

kernel test robot noticed "xfstests.ext4.031.fail" on:

commit: ac16746132e9dafa56057ce201948e8853fd3834 ("[PATCH] ext4: bail out when EXT4_INLINE_DATA_FL lacks system.data xattr")
url: https://github.com/intel-lab-lkp/linux/commits/Moon-Hee-Lee/ext4-bail-out-when-EXT4_INLINE_DATA_FL-lacks-system-data-xattr/20250711-020009
base: https://git.kernel.org/cgit/linux/kernel/git/tytso/ext4.git dev
patch link: https://lore.kernel.org/all/20250710175837.29822-2-moonhee.lee.ca@gmail.com/
patch subject: [PATCH] ext4: bail out when EXT4_INLINE_DATA_FL lacks system.data xattr

in testcase: xfstests
version: xfstests-x86_64-e1e4a0ea-1_20250714
with following parameters:

	bp1_memmap: 4G!8G
	bp2_memmap: 4G!16G
	disk: 2pmem
	fs: ext4
	test: ext4-031


config: x86_64-rhel-9.4-func
compiler: gcc-12
test machine: 8 threads Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz (Skylake) with 28G memory

(please refer to attached dmesg/kmsg for entire log/backtrace)


If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202507220717.738699fb-lkp@intel.com

2025-07-17 19:49:18 export TEST_DIR=/fs/pmem0
2025-07-17 19:49:18 export TEST_DEV=/dev/pmem0
2025-07-17 19:49:18 export FSTYP=ext4
2025-07-17 19:49:18 export SCRATCH_MNT=/fs/scratch
2025-07-17 19:49:18 mkdir /fs/scratch -p
2025-07-17 19:49:18 export SCRATCH_DEV=/dev/pmem1
2025-07-17 19:49:18 echo ext4/031
2025-07-17 19:49:18 ./check -E tests/exclude/ext4 ext4/031
FSTYP         -- ext4
PLATFORM      -- Linux/x86_64 lkp-skl-d01 6.15.0-rc4-00053-gac16746132e9 #1 SMP PREEMPT_DYNAMIC Fri Jul 18 03:31:11 CST 2025
MKFS_OPTIONS  -- -F /dev/pmem1
MOUNT_OPTIONS -- -o acl,user_xattr /dev/pmem1 /fs/scratch

ext4/031       - output mismatch (see /lkp/benchmarks/xfstests/results//ext4/031.out.bad)
    --- tests/ext4/031.out	2025-07-14 17:48:52.000000000 +0000
    +++ /lkp/benchmarks/xfstests/results//ext4/031.out.bad	2025-07-17 19:49:20.122098626 +0000
    @@ -1,2 +1,3 @@
     QA output created by 031
    +/lkp/benchmarks/xfstests/tests/ext4/031: line 35: echo: write error: Structure needs cleaning
     Silence is golden
    ...
    (Run 'diff -u /lkp/benchmarks/xfstests/tests/ext4/031.out /lkp/benchmarks/xfstests/results//ext4/031.out.bad'  to see the entire diff)
Ran: ext4/031
Failures: ext4/031
Failed 1 of 1 tests


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250722/202507220717.738699fb-lkp@intel.com


-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki