Re: [PATCH v2] ext4: fix WARNING in ext4_expand_extra_isize_ea

["yebin (H)" <yebin10@huawei.com>]

On 2022/12/2 0:00, Theodore Ts'o wrote:
> On Thu, Dec 01, 2022 at 10:59:23PM +0800, Ye Bin wrote:
>> Reason is allocate 16M memory by kmalloc, but MAX_ORDER is 11, kmalloc
>> can allocate maxium size memory is 4M.
>> XATTR_SIZE_MAX is currently 64k, but EXT4_XATTR_SIZE_MAX is '(1 << 24)',
>> so 'ext4_xattr_check_entries()' regards this length as legal. Then trigger
>> warning in 'ext4_xattr_move_to_block()'.
>> To solve above issue, according to Jan Kara's suggestion use kvmalloc()
>> to allocate memory in ext4_xattr_move_to_block().
> See my comment to the v1 version of the patch.  I suspect the real
> problem is that the e_value_size is completely bogus, and we should
> have checked it much earlier in the stack call trace, via a call to
> xattr_check_inode().
Yes, Not only the e_value_size is wrong, but also the inode is wrong:
EXT4-fs: Ignoring removed nobh option
EXT4-fs error (device loop0): ext4_xattr_inode_iget:389: comm rep: inode 
#1: comm rep: iget: illegal inode #
EXT4-fs error (device loop0): ext4_xattr_inode_iget:392: comm rep: error 
while reading EA inode 1 err=-117
EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2788: Unable 
to expand inode 15. Delete some EAs or run e2fsck.

Maybe we can do follow check  in ext4_xattr_check_entries() when 
"entry->e_value_inum != 0".
···
err = ext4_xattr_inode_iget(inode, le32_to_cpu(entry->e_value_inum),
                             le32_to_cpu(entry->e_hash), &ea_inode);
if (err) {
         ea_inode = NULL;
         goto out;
}

if (i_size_read(ea_inode) != size) {
         ext4_warning_inode(ea_inode,
                            "ea_inode file size=%llu entry size=%zu",
                            i_size_read(ea_inode), size);
         err = -EFSCORRUPTED;
         goto out;
}
···
>
> Cheers,
>
> 					- Ted
>
> .
>