[PATCH v2] ocfs2: validate global bitmap cl_bpc before resize

[PATCH v2] ocfs2: validate global bitmap cl_bpc before resize

[ZhengYuan Huang]

[BUG]
A corrupted global bitmap inode can make online group extension scan past
the end of a group descriptor bitmap:

BUG: KASAN: use-after-free in _find_next_bit+0xef/0x120 lib/find_bit.c:157
Read of size 8 at addr ffff888021b52000 by task syz.0.34/409
Call Trace:
 ...
 _find_next_bit+0xef/0x120 lib/find_bit.c:157
 find_next_bit include/linux/find.h:73 [inline]
 find_next_bit_le include/linux/find.h:518 [inline]
 ocfs2_find_max_contig_free_bits+0x53/0xb0 fs/ocfs2/suballoc.c:1292
 ocfs2_update_last_group_and_inode fs/ocfs2/resize.c:127 [inline]
 ocfs2_group_extend+0x83e/0x1ae0 fs/ocfs2/resize.c:350
 ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583
 ...

[CAUSE]
ocfs2_group_extend() consumes the global bitmap dinode's cl_bpc value in
resize arithmetic. The existing inode validation checked cl_bpc only for
non-global chain allocators, so a corrupted global bitmap value could reach
the resize path. With cl_bpc changed from 1 to 51457, extending by seven
clusters wraps the u16 bit count and grows a 2048-bit group to 34567 bits,
exceeding its 32256-bit bitmap capacity.

[FIX]
Validate cl_bpc in ocfs2_validate_inode_block() for every chain allocator,
including the global bitmap, against the value derived from the
filesystem's cluster and block sizes. This rejects the corrupted dinode
when it is read and removes the resize-local check that incorrectly assumed
cl_bpc is always one. The resize path still uses the validated value for
its arithmetic.

Fixes: d659072f7368 ("[PATCH 1/2] ocfs2: Add group extend for online resize")
Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
---
v2:
- Derive the expected cl_bpc from the filesystem block and cluster sizes.
- Extend the existing inode-block validation to cover the global bitmap.
- Remove the resize-local hardcoded cl_bpc check.
---
---
 fs/ocfs2/inode.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index 41db7dd39ed9..0e1f9ae0eb73 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -1683,12 +1683,11 @@ int ocfs2_validate_inode_block(struct super_block *sb,
 					 le16_to_cpu(cl->cl_next_free_rec));
 			goto bail;
 		}
-		if (OCFS2_SB(sb)->bitmap_blkno &&
-		    OCFS2_SB(sb)->bitmap_blkno != le64_to_cpu(di->i_blkno) &&
-		    le16_to_cpu(cl->cl_bpc) != bpc) {
-			rc = ocfs2_error(sb, "Invalid dinode %llu: bits per cluster %u\n",
+		if (le16_to_cpu(cl->cl_bpc) != bpc) {
+			rc = ocfs2_error(sb,
+					 "Invalid dinode %llu: bits per cluster %u (expected %u)\n",
 					 (unsigned long long)bh->b_blocknr,
-					 le16_to_cpu(cl->cl_bpc));
+					 le16_to_cpu(cl->cl_bpc), bpc);
 			goto bail;
 		}
 	}
-- 
2.43.0

Re: [PATCH v2] ocfs2: validate global bitmap cl_bpc before resize

[Joseph Qi]

On 8/4/26 2:44 PM, ZhengYuan Huang wrote:
> [BUG]
> A corrupted global bitmap inode can make online group extension scan past
> the end of a group descriptor bitmap:
> 
> BUG: KASAN: use-after-free in _find_next_bit+0xef/0x120 lib/find_bit.c:157
> Read of size 8 at addr ffff888021b52000 by task syz.0.34/409
> Call Trace:
>  ...
>  _find_next_bit+0xef/0x120 lib/find_bit.c:157
>  find_next_bit include/linux/find.h:73 [inline]
>  find_next_bit_le include/linux/find.h:518 [inline]
>  ocfs2_find_max_contig_free_bits+0x53/0xb0 fs/ocfs2/suballoc.c:1292
>  ocfs2_update_last_group_and_inode fs/ocfs2/resize.c:127 [inline]
>  ocfs2_group_extend+0x83e/0x1ae0 fs/ocfs2/resize.c:350
>  ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869
>  vfs_ioctl fs/ioctl.c:51 [inline]
>  __do_sys_ioctl fs/ioctl.c:597 [inline]
>  __se_sys_ioctl fs/ioctl.c:583 [inline]
>  __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583
>  ...
> 
> [CAUSE]
> ocfs2_group_extend() consumes the global bitmap dinode's cl_bpc value in
> resize arithmetic. The existing inode validation checked cl_bpc only for
> non-global chain allocators, so a corrupted global bitmap value could reach
> the resize path. With cl_bpc changed from 1 to 51457, extending by seven
> clusters wraps the u16 bit count and grows a 2048-bit group to 34567 bits,
> exceeding its 32256-bit bitmap capacity.
> 
> [FIX]
> Validate cl_bpc in ocfs2_validate_inode_block() for every chain allocator,
> including the global bitmap, against the value derived from the
> filesystem's cluster and block sizes. This rejects the corrupted dinode
> when it is read and removes the resize-local check that incorrectly assumed
> cl_bpc is always one. The resize path still uses the validated value for
> its arithmetic.

It seems a stale message here.

Thanks,
Joseph
> 
> Fixes: d659072f7368 ("[PATCH 1/2] ocfs2: Add group extend for online resize")
> Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
> ---
> v2:
> - Derive the expected cl_bpc from the filesystem block and cluster sizes.
> - Extend the existing inode-block validation to cover the global bitmap.
> - Remove the resize-local hardcoded cl_bpc check.
> ---
> ---
>  fs/ocfs2/inode.c | 9 ++++-----
>  1 file changed, 4 insertions(+), 5 deletions(-)
> 
> diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
> index 41db7dd39ed9..0e1f9ae0eb73 100644
> --- a/fs/ocfs2/inode.c
> +++ b/fs/ocfs2/inode.c
> @@ -1683,12 +1683,11 @@ int ocfs2_validate_inode_block(struct super_block *sb,
>  					 le16_to_cpu(cl->cl_next_free_rec));
>  			goto bail;
>  		}
> -		if (OCFS2_SB(sb)->bitmap_blkno &&
> -		    OCFS2_SB(sb)->bitmap_blkno != le64_to_cpu(di->i_blkno) &&
> -		    le16_to_cpu(cl->cl_bpc) != bpc) {
> -			rc = ocfs2_error(sb, "Invalid dinode %llu: bits per cluster %u\n",
> +		if (le16_to_cpu(cl->cl_bpc) != bpc) {
> +			rc = ocfs2_error(sb,
> +					 "Invalid dinode %llu: bits per cluster %u (expected %u)\n",
>  					 (unsigned long long)bh->b_blocknr,
> -					 le16_to_cpu(cl->cl_bpc));
> +					 le16_to_cpu(cl->cl_bpc), bpc);
>  			goto bail;
>  		}
>  	}