Re: [PATCH] Fix: ext4: guard against EA inode refcount underflow in xattr update

["Theodore Ts'o" <tytso@mit.edu>]

On Thu, Sep 18, 2025 at 11:18:01AM -0700, Darrick J. Wong wrote:
> > diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
> > index 5a6fe1513fd2..a056f98579c3 100644
> > --- a/fs/ext4/xattr.c
> > +++ b/fs/ext4/xattr.c
> > @@ -1030,6 +1030,13 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode,
> >  
> >  	ref_count = ext4_xattr_inode_get_ref(ea_inode);
> >  	ref_count += ref_change;
> > +	if (ref_count < 0) {
> 
> Shouldn't this check ref_count >= ref_change *before* updating it?

As Ahmet pointed out, so long as we don't actually update the on-disk
data structure, it's fine.  The issue I'm more concerned about is that
if ref_change is +1, we could also have an overflow where we go from
an ridiculously large positive number (~0) to 0.

Your change might fix one potential syzbot-discovered issue caused by
a maliciously fuzzed file system, but we should harden it against
similar problems going in the opposite problem.

Cheers,

						- Ted