* Forwarded: [PATCH] ext4: fix use-after-free in ext4_search_dir via corrupted inline xattr
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
@ 2025-10-02 5:09 ` syzbot
2025-10-02 6:18 ` Forwarded: [PATCH] ext4: reject system.data xattr with external inode storage syzbot
` (20 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-02 5:09 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: fix use-after-free in ext4_search_dir via corrupted inline xattr
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Add bounds validation for inline directory xattr data to prevent
use-after-free when accessing corrupted filesystems.
ext4_find_inline_entry() performs two directory searches: first in
the i_block area, then in the extended attribute (xattr) area of the
inode. When calculating inline_start for the xattr area via
ext4_get_inline_xattr_pos(), the function trusts the e_value_offs
field from disk without validating the resulting pointer stays within
the inode's boundaries.
A corrupted filesystem can craft a malicious e_value_offs value that
causes inline_start to point outside the inode's allocated space,
potentially into freed memory. When ext4_search_dir() attempts to
access this invalid pointer, it results in a KASAN use-after-free.
Fix this by validating that inline_start and inline_start + inline_size
remain within the inode's boundaries before calling ext4_search_dir().
Return -EFSCORRUPTED if the bounds check fails.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inline.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 1b094a4f3866..28ac90a8d5a2 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1617,7 +1617,15 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
inline_start = ext4_get_inline_xattr_pos(dir, &is.iloc);
inline_size = ext4_get_inline_size(dir) - EXT4_MIN_INLINE_DATA_SIZE;
-
+ void *inode_start = ext4_raw_inode(&is.iloc);
+ void *inode_end = inode_start + EXT4_INODE_SIZE(dir->i_sb);
+
+ if (inline_start < inode_start ||
+ inline_start >= inode_end ||
+ inline_start + inline_size > inode_end) {
+ ret = -EFSCORRUPTED;
+ goto out;
+ }
ret = ext4_search_dir(is.iloc.bh, inline_start, inline_size,
dir, fname, 0, res_dir);
if (ret == 1)
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject system.data xattr with external inode storage
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
2025-10-02 5:09 ` Forwarded: [PATCH] ext4: fix use-after-free in ext4_search_dir via corrupted inline xattr syzbot
@ 2025-10-02 6:18 ` syzbot
2025-10-02 6:28 ` syzbot
` (19 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-02 6:18 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject system.data xattr with external inode storage
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting malformed
inline directory xattr entries during validation.
ext4 uses the system.data xattr to store inline directory entries
within the inode. This xattr must always use inline storage
(e_value_inum == 0). However, a corrupted filesystem can craft a
system.data xattr entry with e_value_inum != 0, bypassing the existing
validation in check_xattrs() which only validates e_value_offs when
e_value_inum == 0.
Later, when ext4_find_inline_entry() is called, ext4_get_inline_xattr_pos()
reads the corrupt e_value_offs and calculates an inline_start pointer
that can point outside the inode buffer, potentially into freed memory.
When ext4_search_dir() attempts to access this invalid pointer, it
results in a KASAN use-after-free.
Fix this by explicitly validating that system.data xattr entries always
have e_value_inum == 0 in check_xattrs(). This catches the corruption
at validation time during inode load, before the corrupt pointer can be
used.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/xattr.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 5a6fe1513fd2..a9057d0f9e24 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -251,6 +251,13 @@ check_xattrs(struct inode *inode, struct buffer_head *bh,
err_str = "invalid ea_ino";
goto errout;
}
+ if (entry->e_name_index == EXT4_XATTR_INDEX_SYSTEM &&
+ entry->e_name_len == sizeof(EXT4_XATTR_SYSTEM_DATA) - 1 &&
+ !memcmp(entry->e_name, EXT4_XATTR_SYSTEM_DATA, entry->e_name_len) &&
+ ea_ino != 0) {
+ err_str = "system.data xattr cannot use external inode storage";
+ goto errout;
+ }
if (size > EXT4_XATTR_SIZE_MAX) {
err_str = "e_value size too large";
goto errout;
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject system.data xattr with external inode storage
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
2025-10-02 5:09 ` Forwarded: [PATCH] ext4: fix use-after-free in ext4_search_dir via corrupted inline xattr syzbot
2025-10-02 6:18 ` Forwarded: [PATCH] ext4: reject system.data xattr with external inode storage syzbot
@ 2025-10-02 6:28 ` syzbot
2025-10-02 9:38 ` syzbot
` (18 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-02 6:28 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject system.data xattr with external inode storage
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting malformed
inline directory xattr entries during validation.
ext4 uses the system.data xattr to store inline directory entries
within the inode. This xattr must always use inline storage
(e_value_inum == 0). However, a corrupted filesystem can craft a
system.data xattr entry with e_value_inum != 0, bypassing the existing
validation in check_xattrs() which only validates e_value_offs when
e_value_inum == 0.
Later, when ext4_find_inline_entry() is called, ext4_get_inline_xattr_pos()
reads the corrupt e_value_offs and calculates an inline_start pointer
that can point outside the inode buffer, potentially into freed memory.
When ext4_search_dir() attempts to access this invalid pointer, it
results in a KASAN use-after-free.
Fix this by explicitly validating that system.data xattr entries always
have e_value_inum == 0 in check_xattrs(). This catches the corruption
at validation time during inode load, before the corrupt pointer can be
used.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/xattr.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 5a6fe1513fd2..8680f649ea7e 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -251,6 +251,13 @@ check_xattrs(struct inode *inode, struct buffer_head *bh,
err_str = "invalid ea_ino";
goto errout;
}
+ if (entry->e_name_index == EXT4_XATTR_INDEX_SYSTEM &&
+ entry->e_name_len == 4 &&
+ !memcmp(entry->e_name, "data", 4) &&
+ ea_ino != 0) {
+ err_str = "system.data xattr cannot use external inode storage";
+ goto errout;
+ }
if (size > EXT4_XATTR_SIZE_MAX) {
err_str = "e_value size too large";
goto errout;
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject system.data xattr with external inode storage
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (2 preceding siblings ...)
2025-10-02 6:28 ` syzbot
@ 2025-10-02 9:38 ` syzbot
2025-10-02 10:01 ` Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero syzbot
` (17 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-02 9:38 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject system.data xattr with external inode storage
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inline directory
xattr entries that claim to use external inode storage.
ext4 uses the system.data xattr to store inline directory entries
within the inode. When an inode has the EXT4_INODE_INLINE_DATA flag set,
the system.data xattr must use inline storage (e_value_inum == 0).
However, a corrupted filesystem can craft a system.data xattr entry with
e_value_inum != 0, creating an inconsistency. The existing validation in
check_xattrs() skips e_value_offs validation when e_value_inum != 0,
allowing a corrupt e_value_offs to pass through unchecked.
Later, when ext4_find_inline_entry() is called, ext4_get_inline_xattr_pos()
reads the corrupt e_value_offs and calculates an inline_start pointer that
can point outside the inode buffer, potentially into freed memory. When
ext4_search_dir() attempts to access this invalid pointer, it results in
a KASAN use-after-free.
Fix this by validating in check_xattrs() that if an inode has the inline
data flag set, the system.data xattr entry must have e_value_inum == 0.
This enforces the consistency between the inode flag and xattr storage
type, catching the corruption at validation time during inode load before
the corrupt pointer can be used.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/xattr.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 8680f649ea7e..827f2b6175d0 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -195,7 +195,7 @@ check_xattrs(struct inode *inode, struct buffer_head *bh,
struct ext4_xattr_entry *e = entry;
int err = -EFSCORRUPTED;
char *err_str;
-
+ printk(KERN_WARNING "ext_check_xattrs: entered in function\n");
if (bh) {
if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
BHDR(bh)->h_blocks != cpu_to_le32(1)) {
@@ -251,12 +251,18 @@ check_xattrs(struct inode *inode, struct buffer_head *bh,
err_str = "invalid ea_ino";
goto errout;
}
- if (entry->e_name_index == EXT4_XATTR_INDEX_SYSTEM &&
- entry->e_name_len == 4 &&
- !memcmp(entry->e_name,"data", 4) &&
- ea_ino != 0) {
+ if (ext4_has_inline_data(inode) && ea_ino != 0) {
err_str = "system.data xattr cannot use external inode storage";
- goto errout;
+ goto errout;
+ }
+ if (entry->e_name_index == EXT4_XATTR_INDEX_SYSTEM &&
+ entry->e_name_len == 4 &&
+ !memcmp(entry->e_name, "data", 4)) {
+ printk(KERN_ERR "Found system.data xattr: ea_ino=%lu\n", ea_ino);
+ if (ext4_has_inline_data(inode) && ea_ino != 0) {
+ err_str = "system.data xattr cannot use external inode storage";
+ goto errout;
+ }
}
if (size > EXT4_XATTR_SIZE_MAX) {
err_str = "e_value size too large";
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (3 preceding siblings ...)
2025-10-02 9:38 ` syzbot
@ 2025-10-02 10:01 ` syzbot
2025-10-02 22:57 ` syzbot
` (16 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-02 10:01 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that
claim to have inline data but have no extra inode space allocated.
ext4 inline data is stored in the extra inode space beyond the
standard 128-byte inode structure. This requires i_extra_isize to be
non-zero to provide space for the system.data xattr that stores the
inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both:
- i_extra_isize == 0 (no extra space)
- EXT4_INODE_INLINE_DATA flag set (claims to use extra space)
This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the
inline xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free.
Fix this by validating in ext4_iget() that if an inode has the
EXT4_INODE_INLINE_DATA flag set, i_extra_isize must be non-zero.
This catches the corruption at inode load time before any inline
data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..d76800c65317 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5417,6 +5417,12 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
if (ei->i_extra_isize == 0) {
+ if (ext4_has_inline_data(inode)) {
+ ext4_error_inode(inode, function, line, 0,
+ "inline data flag set but i_extra_isize is zero");
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+ }
/* The extra space is currently unused. Use it. */
BUILD_BUG_ON(sizeof(struct ext4_inode) & 3);
ei->i_extra_isize = sizeof(struct ext4_inode) -
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (4 preceding siblings ...)
2025-10-02 10:01 ` Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero syzbot
@ 2025-10-02 22:57 ` syzbot
2025-10-02 23:54 ` Forwarded: [PATCH] ext4: reject system.data xattr with external inode storage syzbot
` (15 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-02 22:57 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that
claim to have inline data but have no extra inode space allocated.
ext4 inline data is stored in the extra inode space beyond the
standard 128-byte inode structure. This requires i_extra_isize to be
non-zero to provide space for the system.data xattr that stores the
inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both:
- i_extra_isize == 0 (no extra space)
- EXT4_INODE_INLINE_DATA flag set (claims to use extra space)
This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the
inline xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free.
Fix this by validating in ext4_iget() that if an inode has the
EXT4_INODE_INLINE_DATA flag set, i_extra_isize must be non-zero.
This catches the corruption at inode load time before any inline
data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
Changes in v2:
- Use ext4_test_inode_flag() instead of ext4_has_inline_data() as
suggested by Theodore Ts'o, since i_inline_off is not yet initialized
at this point in ext4_iget()
---
fs/ext4/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..fe30d4192c7d 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5417,6 +5417,12 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
if (ei->i_extra_isize == 0) {
+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA)) {
+ ext4_error_inode(inode, function, line, 0,
+ "inline data flag set but i_extra_isize is zero");
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+ }
/* The extra space is currently unused. Use it. */
BUILD_BUG_ON(sizeof(struct ext4_inode) & 3);
ei->i_extra_isize = sizeof(struct ext4_inode) -
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject system.data xattr with external inode storage
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (5 preceding siblings ...)
2025-10-02 22:57 ` syzbot
@ 2025-10-02 23:54 ` syzbot
2025-10-03 0:23 ` Forwarded: [PATCH] ext4: fix use-after-free in ext4_search_dir via corrupted inline xattr syzbot
` (14 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-02 23:54 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject system.data xattr with external inode storage
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inline directory
xattr entries that claim to use external inode storage.
ext4 uses the "system.data" xattr to store inline directory entries
within the inode. When an inode has the EXT4_INODE_INLINE_DATA flag set,
the system.data xattr must use inline storage (e_value_inum == 0).
However, a corrupted filesystem can craft a system.data xattr entry with
e_value_inum != 0, creating an inconsistency. The existing validation in
check_xattrs() skips e_value_offs validation when e_value_inum != 0,
allowing a corrupt e_value_offs to pass through unchecked.
Later, when ext4_find_inline_entry() is called, ext4_get_inline_xattr_pos()
reads the corrupt e_value_offs and calculates an inline_start pointer that
can point outside the inode buffer, potentially into freed memory. When
ext4_search_dir() attempts to access this invalid pointer, it results in
a KASAN use-after-free.
Fix this by validating in check_xattrs() that if an inode has the inline
data flag set, the system.data xattr entry must have e_value_inum == 0.
This enforces the consistency between the inode flag and xattr storage
type, catching the corruption at validation time during inode load before
the corrupt pointer can be used.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..d082fff675ac 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5417,6 +5417,12 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
if (ei->i_extra_isize == 0) {
+ if (ext4_has_inline_data(inode)) {
+ ext4_error_inode(inode, function, line, 0,
+ "inline data flag set but i_extra_isize is zero");
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+ }
/* The extra space is currently unused. Use it. */
BUILD_BUG_ON(sizeof(struct ext4_inode) & 3);
ei->i_extra_isize = sizeof(struct ext4_inode) -
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: fix use-after-free in ext4_search_dir via corrupted inline xattr
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (6 preceding siblings ...)
2025-10-02 23:54 ` Forwarded: [PATCH] ext4: reject system.data xattr with external inode storage syzbot
@ 2025-10-03 0:23 ` syzbot
2025-10-03 1:07 ` Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero syzbot
` (13 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-03 0:23 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: fix use-after-free in ext4_search_dir via corrupted inline xattr
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Add bounds validation for inline directory xattr data to prevent
use-after-free when accessing corrupted filesystems.
ext4_find_inline_entry() performs two directory searches: first in
the i_block area, then in the extended attribute (xattr) area of the
inode. When calculating inline_start for the xattr area via
ext4_get_inline_xattr_pos(), the function trusts the e_value_offs
field from disk without validating the resulting pointer stays within
the inode's boundaries.
A corrupted filesystem can craft a malicious e_value_offs value that
causes inline_start to point outside the inode's allocated space,
potentially into freed memory. When ext4_search_dir() attempts to
access this invalid pointer, it results in a KASAN use-after-free.
Fix this by validating that inline_start and inline_start + inline_size
remain within the inode's boundaries before calling ext4_search_dir().
Return -EFSCORRUPTED if the bounds check fails.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inline.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 1b094a4f3866..28ac90a8d5a2 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1617,7 +1617,15 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
inline_start = ext4_get_inline_xattr_pos(dir, &is.iloc);
inline_size = ext4_get_inline_size(dir) - EXT4_MIN_INLINE_DATA_SIZE;
-
+ void *inode_start = ext4_raw_inode(&is.iloc);
+ void *inode_end = inode_start + EXT4_INODE_SIZE(dir->i_sb);
+
+ if (inline_start < inode_start ||
+ inline_start >= inode_end ||
+ inline_start + inline_size > inode_end) {
+ ret = -EFSCORRUPTED;
+ goto out;
+ }
ret = ext4_search_dir(is.iloc.bh, inline_start, inline_size,
dir, fname, 0, res_dir);
if (ret == 1)
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (7 preceding siblings ...)
2025-10-03 0:23 ` Forwarded: [PATCH] ext4: fix use-after-free in ext4_search_dir via corrupted inline xattr syzbot
@ 2025-10-03 1:07 ` syzbot
2025-10-03 1:40 ` syzbot
` (12 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-03 1:07 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that
claim to have inline data but have no extra inode space allocated.
ext4 inline data is stored in the extra inode space beyond the
standard 128-byte inode structure. This requires i_extra_isize to be
non-zero to provide space for the system.data xattr that stores the
inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both:
- i_extra_isize == 0 (no extra space)
- EXT4_INODE_INLINE_DATA flag set (claims to use extra space)
This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the
inline xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free.
Fix this by validating in ext4_iget() that if an inode has the
EXT4_INODE_INLINE_DATA flag set, i_extra_isize must be non-zero.
This catches the corruption at inode load time before any inline
data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inode.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..8682ee8f1e50 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5414,6 +5414,13 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_sync_tid = tid;
ei->i_datasync_tid = tid;
}
+ if (EXT4_INODE_SIZE(inode->i_sb) < EXT4_GOOD_OLD_INODE_SIZE) {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has less data");
+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA)) {
+ ext4_error_inode(inode, function, line, 0, "wow! this inode is line");
+ }
+ }
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
if (ei->i_extra_isize == 0) {
@@ -5422,6 +5429,8 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_extra_isize = sizeof(struct ext4_inode) -
EXT4_GOOD_OLD_INODE_SIZE;
} else {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has reached ext4 iget");
ret = ext4_iget_extra_inode(inode, raw_inode, ei);
if (ret)
goto bad_inode;
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (8 preceding siblings ...)
2025-10-03 1:07 ` Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero syzbot
@ 2025-10-03 1:40 ` syzbot
2025-10-03 2:02 ` syzbot
` (11 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-03 1:40 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that
claim to have inline data but have no extra inode space allocated.
ext4 inline data is stored in the extra inode space beyond the
standard 128-byte inode structure. This requires i_extra_isize to be
non-zero to provide space for the system.data xattr that stores the
inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both:
- i_extra_isize == 0 (no extra space)
- EXT4_INODE_INLINE_DATA flag set (claims to use extra space)
This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the
inline xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free.
Fix this by validating in ext4_iget() that if an inode has the
EXT4_INODE_INLINE_DATA flag set, i_extra_isize must be non-zero.
This catches the corruption at inode load time before any inline
data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inode.c | 13 ++++++++++++-
fs/ext4/xattr.c | 2 +-
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..257e9b1c6416 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5099,7 +5099,8 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
if (EXT4_INODE_HAS_XATTR_SPACE(inode) &&
*magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
int err;
-
+ ext4_error_inode(inode, "ext4_iget_extra_inode", 5102, 0,
+ "wow this inode has extra space");
err = xattr_check_inode(inode, IHDR(inode, raw_inode),
ITAIL(inode, raw_inode));
if (err)
@@ -5112,6 +5113,7 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
return err;
} else
EXT4_I(inode)->i_inline_off = 0;
+
return 0;
}
@@ -5414,6 +5416,13 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_sync_tid = tid;
ei->i_datasync_tid = tid;
}
+ if (EXT4_INODE_SIZE(inode->i_sb) < EXT4_GOOD_OLD_INODE_SIZE) {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has less data");
+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA)) {
+ ext4_error_inode(inode, function, line, 0, "wow! this inode is line");
+ }
+ }
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
if (ei->i_extra_isize == 0) {
@@ -5422,6 +5431,8 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_extra_isize = sizeof(struct ext4_inode) -
EXT4_GOOD_OLD_INODE_SIZE;
} else {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has reached ext4 iget");
ret = ext4_iget_extra_inode(inode, raw_inode, ei);
if (ret)
goto bad_inode;
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 5a6fe1513fd2..9b4a6978b313 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -195,7 +195,7 @@ check_xattrs(struct inode *inode, struct buffer_head *bh,
struct ext4_xattr_entry *e = entry;
int err = -EFSCORRUPTED;
char *err_str;
-
+ ext4_error_inode(inode, "check_xattrs", 198, 0, "wow! we are in check_xattrs");
if (bh) {
if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
BHDR(bh)->h_blocks != cpu_to_le32(1)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (9 preceding siblings ...)
2025-10-03 1:40 ` syzbot
@ 2025-10-03 2:02 ` syzbot
2025-10-03 3:02 ` syzbot
` (10 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-03 2:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that
claim to have inline data but have no extra inode space allocated.
ext4 inline data is stored in the extra inode space beyond the
standard 128-byte inode structure. This requires i_extra_isize to be
non-zero to provide space for the system.data xattr that stores the
inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both:
- i_extra_isize == 0 (no extra space)
- EXT4_INODE_INLINE_DATA flag set (claims to use extra space)
This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the
inline xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free.
Fix this by validating in ext4_iget() that if an inode has the
EXT4_INODE_INLINE_DATA flag set, i_extra_isize must be non-zero.
This catches the corruption at inode load time before any inline
data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inode.c | 13 ++++++++++++-
fs/ext4/xattr.c | 2 +-
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..257e9b1c6416 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5099,7 +5099,8 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
if (EXT4_INODE_HAS_XATTR_SPACE(inode) &&
*magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
int err;
-
+ ext4_error_inode(inode, "ext4_iget_extra_inode", 5102, 0,
+ "wow this inode has extra space");
err = xattr_check_inode(inode, IHDR(inode, raw_inode),
ITAIL(inode, raw_inode));
if (err)
@@ -5112,6 +5113,7 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
return err;
} else
EXT4_I(inode)->i_inline_off = 0;
+
return 0;
}
@@ -5414,6 +5416,13 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_sync_tid = tid;
ei->i_datasync_tid = tid;
}
+ if (EXT4_INODE_SIZE(inode->i_sb) < EXT4_GOOD_OLD_INODE_SIZE) {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has less data");
+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA)) {
+ ext4_error_inode(inode, function, line, 0, "wow! this inode is line");
+ }
+ }
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
if (ei->i_extra_isize == 0) {
@@ -5422,6 +5431,8 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_extra_isize = sizeof(struct ext4_inode) -
EXT4_GOOD_OLD_INODE_SIZE;
} else {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has reached ext4 iget");
ret = ext4_iget_extra_inode(inode, raw_inode, ei);
if (ret)
goto bad_inode;
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 5a6fe1513fd2..9b4a6978b313 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -195,7 +195,7 @@ check_xattrs(struct inode *inode, struct buffer_head *bh,
struct ext4_xattr_entry *e = entry;
int err = -EFSCORRUPTED;
char *err_str;
-
+ ext4_error_inode(inode, "check_xattrs", 198, 0, "wow! we are in check_xattrs");
if (bh) {
if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
BHDR(bh)->h_blocks != cpu_to_le32(1)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (10 preceding siblings ...)
2025-10-03 2:02 ` syzbot
@ 2025-10-03 3:02 ` syzbot
2025-10-03 3:16 ` syzbot
` (9 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-03 3:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that
claim to have inline data but have no extra inode space allocated.
ext4 inline data is stored in the extra inode space beyond the
standard 128-byte inode structure. This requires i_extra_isize to be
non-zero to provide space for the system.data xattr that stores the
inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both:
- i_extra_isize == 0 (no extra space)
- EXT4_INODE_INLINE_DATA flag set (claims to use extra space)
This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the
inline xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free.
Fix this by validating in ext4_iget() that if an inode has the
EXT4_INODE_INLINE_DATA flag set, i_extra_isize must be non-zero.
This catches the corruption at inode load time before any inline
data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inode.c | 13 ++++++++++++-
fs/ext4/xattr.c | 2 +-
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..257e9b1c6416 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5099,7 +5099,8 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
if (EXT4_INODE_HAS_XATTR_SPACE(inode) &&
*magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
int err;
-
+ ext4_error_inode(inode, "ext4_iget_extra_inode", 5102, 0,
+ "wow this inode has extra space");
err = xattr_check_inode(inode, IHDR(inode, raw_inode),
ITAIL(inode, raw_inode));
if (err)
@@ -5112,6 +5113,7 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
return err;
} else
EXT4_I(inode)->i_inline_off = 0;
+
return 0;
}
@@ -5414,6 +5416,13 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_sync_tid = tid;
ei->i_datasync_tid = tid;
}
+ if (EXT4_INODE_SIZE(inode->i_sb) < EXT4_GOOD_OLD_INODE_SIZE) {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has less data");
+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA)) {
+ ext4_error_inode(inode, function, line, 0, "wow! this inode is line");
+ }
+ }
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
if (ei->i_extra_isize == 0) {
@@ -5422,6 +5431,8 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_extra_isize = sizeof(struct ext4_inode) -
EXT4_GOOD_OLD_INODE_SIZE;
} else {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has reached ext4 iget");
ret = ext4_iget_extra_inode(inode, raw_inode, ei);
if (ret)
goto bad_inode;
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 5a6fe1513fd2..9b4a6978b313 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -195,7 +195,7 @@ check_xattrs(struct inode *inode, struct buffer_head *bh,
struct ext4_xattr_entry *e = entry;
int err = -EFSCORRUPTED;
char *err_str;
-
+ ext4_error_inode(inode, "check_xattrs", 198, 0, "wow! we are in check_xattrs");
if (bh) {
if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
BHDR(bh)->h_blocks != cpu_to_le32(1)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (11 preceding siblings ...)
2025-10-03 3:02 ` syzbot
@ 2025-10-03 3:16 ` syzbot
2025-10-03 4:02 ` Forwarded: [PATCH] ext4: reject inline data flag when i_extra_size " syzbot
` (8 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-03 3:16 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that claim to
have inline data but have no extra inode space allocated. ext4 inline data is
stored in the extra inode space beyond the standard 128-byte inode structure.
This requires i_extra_isize to be non-zero to provide space for the
system.data xattr that stores the inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both: - i_extra_isize
== 0 (no extra space) - EXT4_INODE_INLINE_DATA flag set (claims to use extra
space) This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the inline
xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free. Fix this by validating in
ext4_iget() that if an inode has the EXT4_INODE_INLINE_DATA flag set,
i_extra_isize must be non-zero. This catches the corruption at inode load
time before any inline data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes:https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inline.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 1b094a4f3866..d6541e661dfa 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1614,9 +1614,19 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
if (ext4_get_inline_size(dir) == EXT4_MIN_INLINE_DATA_SIZE)
goto out;
-
+
inline_start = ext4_get_inline_xattr_pos(dir, &is.iloc);
inline_size = ext4_get_inline_size(dir) - EXT4_MIN_INLINE_DATA_SIZE;
+ void *inode_start = ext4_raw_inode(&is.iloc);
+ void *inode_end = inode_start + EXT4_INODE_SIZE(dir->i_sb);
+
+ if (inline_start < inode_start ||
+ inline_start >= inode_end ||
+ inline_start + inline_size > inode_end) {
+ printk(KERN_WARNING "found error in ext4_find_inline_entry\n");
+ ret = -EFSCORRUPTED;
+ goto out;
+ }
ret = ext4_search_dir(is.iloc.bh, inline_start, inline_size,
dir, fname, 0, res_dir);
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject inline data flag when i_extra_size is zero
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (12 preceding siblings ...)
2025-10-03 3:16 ` syzbot
@ 2025-10-03 4:02 ` syzbot
2025-10-03 6:17 ` Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize " syzbot
` (7 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-03 4:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_size is zero
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that claim to
have inline data but have no extra inode space allocated. ext4 inline data is
stored in the extra inode space beyond the standard 128-byte inode structure.
This requires i_extra_isize to be non-zero to provide space for the
system.data xattr that stores the inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both: - i_extra_isize
== 0 (no extra space) - EXT4_INODE_INLINE_DATA flag set (claims to use extra
space) This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the inline
xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free. Fix this by validating in
ext4_iget() that if an inode has the EXT4_INODE_INLINE_DATA flag set,
i_extra_isize must be non-zero. This catches the corruption at inode load
time before any inline data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes:https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inline.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 1b094a4f3866..d6541e661dfa 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1614,9 +1614,19 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
if (ext4_get_inline_size(dir) == EXT4_MIN_INLINE_DATA_SIZE)
goto out;
-
+
inline_start = ext4_get_inline_xattr_pos(dir, &is.iloc);
inline_size = ext4_get_inline_size(dir) - EXT4_MIN_INLINE_DATA_SIZE;
+ void *inode_start = ext4_raw_inode(&is.iloc);
+ void *inode_end = inode_start + EXT4_INODE_SIZE(dir->i_sb);
+
+ if (inline_start < inode_start ||
+ inline_start >= inode_end ||
+ inline_start + inline_size > inode_end) {
+ printk(KERN_WARNING "found error in ext4_find_inline_entry\n");
+ ret = -EFSCORRUPTED;
+ goto out;
+ }
ret = ext4_search_dir(is.iloc.bh, inline_start, inline_size,
dir, fname, 0, res_dir);
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (13 preceding siblings ...)
2025-10-03 4:02 ` Forwarded: [PATCH] ext4: reject inline data flag when i_extra_size " syzbot
@ 2025-10-03 6:17 ` syzbot
2025-10-03 8:14 ` Forwarded: [PATCH] ext4: reject system.data xattr with external inode storage syzbot
` (6 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-03 6:17 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that
claim to have inline data but have no extra inode space allocated.
ext4 inline data is stored in the extra inode space beyond the
standard 128-byte inode structure. This requires i_extra_isize to be
non-zero to provide space for the system.data xattr that stores the
inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both:
- i_extra_isize == 0 (no extra space)
- EXT4_INODE_INLINE_DATA flag set (claims to use extra space)
This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the
inline xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free.
Fix this by validating in ext4_iget() that if an inode has the
EXT4_INODE_INLINE_DATA flag set, i_extra_isize must be non-zero.
This catches the corruption at inode load time before any inline
data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inode.c | 13 ++++++++++++-
fs/ext4/xattr.c | 2 +-
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..257e9b1c6416 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5099,7 +5099,8 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
if (EXT4_INODE_HAS_XATTR_SPACE(inode) &&
*magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
int err;
-
+ ext4_error_inode(inode, "ext4_iget_extra_inode", 5102, 0,
+ "wow this inode has extra space");
err = xattr_check_inode(inode, IHDR(inode, raw_inode),
ITAIL(inode, raw_inode));
if (err)
@@ -5112,6 +5113,7 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
return err;
} else
EXT4_I(inode)->i_inline_off = 0;
+
return 0;
}
@@ -5414,6 +5416,13 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_sync_tid = tid;
ei->i_datasync_tid = tid;
}
+ if (EXT4_INODE_SIZE(inode->i_sb) < EXT4_GOOD_OLD_INODE_SIZE) {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has less data");
+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA)) {
+ ext4_error_inode(inode, function, line, 0, "wow! this inode is line");
+ }
+ }
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
if (ei->i_extra_isize == 0) {
@@ -5422,6 +5431,8 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_extra_isize = sizeof(struct ext4_inode) -
EXT4_GOOD_OLD_INODE_SIZE;
} else {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has reached ext4 iget");
ret = ext4_iget_extra_inode(inode, raw_inode, ei);
if (ret)
goto bad_inode;
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 5a6fe1513fd2..9b4a6978b313 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -195,7 +195,7 @@ check_xattrs(struct inode *inode, struct buffer_head *bh,
struct ext4_xattr_entry *e = entry;
int err = -EFSCORRUPTED;
char *err_str;
-
+ ext4_error_inode(inode, "check_xattrs", 198, 0, "wow! we are in check_xattrs");
if (bh) {
if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
BHDR(bh)->h_blocks != cpu_to_le32(1)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject system.data xattr with external inode storage
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (14 preceding siblings ...)
2025-10-03 6:17 ` Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize " syzbot
@ 2025-10-03 8:14 ` syzbot
2025-10-03 8:36 ` Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero syzbot
` (5 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-03 8:14 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject system.data xattr with external inode storage
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inline directory
xattr entries that claim to use external inode storage.
ext4 uses the "system.data" xattr to store inline directory entries
within the inode. When an inode has the EXT4_INODE_INLINE_DATA flag set,
the system.data xattr must use inline storage (e_value_inum == 0).
However, a corrupted filesystem can craft a system.data xattr entry with
e_value_inum != 0, creating an inconsistency. The existing validation in
check_xattrs() skips e_value_offs validation when e_value_inum != 0,
allowing a corrupt e_value_offs to pass through unchecked.
Later, when ext4_find_inline_entry() is called, ext4_get_inline_xattr_pos()
reads the corrupt e_value_offs and calculates an inline_start pointer that
can point outside the inode buffer, potentially into freed memory. When
ext4_search_dir() attempts to access this invalid pointer, it results in
a KASAN use-after-free.
Fix this by validating in check_xattrs() that if an inode has the inline
data flag set, the system.data xattr entry must have e_value_inum == 0.
This enforces the consistency between the inode flag and xattr storage
type, catching the corruption at validation time during inode load before
the corrupt pointer can be used.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..d082fff675ac 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5417,6 +5417,12 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
if (ei->i_extra_isize == 0) {
+ if (ext4_has_inline_data(inode)) {
+ ext4_error_inode(inode, function, line, 0,
+ "inline data flag set but i_extra_isize is zero");
+ ret = -EFSCORRUPTED;
+ goto bad_inode;
+ }
/* The extra space is currently unused. Use it. */
BUILD_BUG_ON(sizeof(struct ext4_inode) & 3);
ei->i_extra_isize = sizeof(struct ext4_inode) -
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (15 preceding siblings ...)
2025-10-03 8:14 ` Forwarded: [PATCH] ext4: reject system.data xattr with external inode storage syzbot
@ 2025-10-03 8:36 ` syzbot
2025-10-03 9:09 ` syzbot
` (4 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-10-03 8:36 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that
claim to have inline data but have no extra inode space allocated.
ext4 inline data is stored in the extra inode space beyond the
standard 128-byte inode structure. This requires i_extra_isize to be
non-zero to provide space for the system.data xattr that stores the
inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both:
- i_extra_isize == 0 (no extra space)
- EXT4_INODE_INLINE_DATA flag set (claims to use extra space)
This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the
inline xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free.
Fix this by validating in ext4_iget() that if an inode has the
EXT4_INODE_INLINE_DATA flag set, i_extra_isize must be non-zero.
This catches the corruption at inode load time before any inline
data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inode.c | 13 ++++++++++++-
fs/ext4/xattr.c | 2 +-
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..257e9b1c6416 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5099,7 +5099,8 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
if (EXT4_INODE_HAS_XATTR_SPACE(inode) &&
*magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
int err;
-
+ ext4_error_inode(inode, "ext4_iget_extra_inode", 5102, 0,
+ "wow this inode has extra space");
err = xattr_check_inode(inode, IHDR(inode, raw_inode),
ITAIL(inode, raw_inode));
if (err)
@@ -5112,6 +5113,7 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
return err;
} else
EXT4_I(inode)->i_inline_off = 0;
+
return 0;
}
@@ -5414,6 +5416,13 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_sync_tid = tid;
ei->i_datasync_tid = tid;
}
+ if (EXT4_INODE_SIZE(inode->i_sb) < EXT4_GOOD_OLD_INODE_SIZE) {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has less data");
+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA)) {
+ ext4_error_inode(inode, function, line, 0, "wow! this inode is line");
+ }
+ }
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
if (ei->i_extra_isize == 0) {
@@ -5422,6 +5431,8 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_extra_isize = sizeof(struct ext4_inode) -
EXT4_GOOD_OLD_INODE_SIZE;
} else {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has reached ext4 iget");
ret = ext4_iget_extra_inode(inode, raw_inode, ei);
if (ret)
goto bad_inode;
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 5a6fe1513fd2..9b4a6978b313 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -195,7 +195,7 @@ check_xattrs(struct inode *inode, struct buffer_head *bh,
struct ext4_xattr_entry *e = entry;
int err = -EFSCORRUPTED;
char *err_str;
-
+ ext4_error_inode(inode, "check_xattrs", 198, 0, "wow! we are in check_xattrs");
if (bh) {
if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
BHDR(bh)->h_blocks != cpu_to_le32(1)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (16 preceding siblings ...)
2025-10-03 8:36 ` Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero syzbot
@ 2025-10-03 9:09 ` syzbot
2025-10-14 13:41 ` kerne test robot
2025-11-08 5:34 ` Forwarded: potential fix syzbot
` (3 subsequent siblings)
21 siblings, 1 reply; 24+ messages in thread
From: syzbot @ 2025-10-03 9:09 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that
claim to have inline data but have no extra inode space allocated.
ext4 inline data is stored in the extra inode space beyond the
standard 128-byte inode structure. This requires i_extra_isize to be
non-zero to provide space for the system.data xattr that stores the
inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both:
- i_extra_isize == 0 (no extra space)
- EXT4_INODE_INLINE_DATA flag set (claims to use extra space)
This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the
inline xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free.
Fix this by validating in ext4_iget() that if an inode has the
EXT4_INODE_INLINE_DATA flag set, i_extra_isize must be non-zero.
This catches the corruption at inode load time before any inline
data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inode.c | 13 ++++++++++++-
fs/ext4/xattr.c | 2 +-
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5b7a15db4953..257e9b1c6416 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5099,7 +5099,8 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
if (EXT4_INODE_HAS_XATTR_SPACE(inode) &&
*magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
int err;
-
+ ext4_error_inode(inode, "ext4_iget_extra_inode", 5102, 0,
+ "wow this inode has extra space");
err = xattr_check_inode(inode, IHDR(inode, raw_inode),
ITAIL(inode, raw_inode));
if (err)
@@ -5112,6 +5113,7 @@ static inline int ext4_iget_extra_inode(struct inode *inode,
return err;
} else
EXT4_I(inode)->i_inline_off = 0;
+
return 0;
}
@@ -5414,6 +5416,13 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_sync_tid = tid;
ei->i_datasync_tid = tid;
}
+ if (EXT4_INODE_SIZE(inode->i_sb) < EXT4_GOOD_OLD_INODE_SIZE) {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has less data");
+ if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA)) {
+ ext4_error_inode(inode, function, line, 0, "wow! this inode is line");
+ }
+ }
if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
if (ei->i_extra_isize == 0) {
@@ -5422,6 +5431,8 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ei->i_extra_isize = sizeof(struct ext4_inode) -
EXT4_GOOD_OLD_INODE_SIZE;
} else {
+ ext4_error_inode(inode, function, line, 0,
+ "wow! this inode has reached ext4 iget");
ret = ext4_iget_extra_inode(inode, raw_inode, ei);
if (ret)
goto bad_inode;
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 5a6fe1513fd2..9b4a6978b313 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -195,7 +195,7 @@ check_xattrs(struct inode *inode, struct buffer_head *bh,
struct ext4_xattr_entry *e = entry;
int err = -EFSCORRUPTED;
char *err_str;
-
+ ext4_error_inode(inode, "check_xattrs", 198, 0, "wow! we are in check_xattrs");
if (bh) {
if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
BHDR(bh)->h_blocks != cpu_to_le32(1)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
2025-10-03 9:09 ` syzbot
@ 2025-10-14 13:41 ` kerne test robot
0 siblings, 0 replies; 24+ messages in thread
From: kerne test robot @ 2025-10-14 13:41 UTC (permalink / raw)
To: syzbot
Cc: oe-lkp, lkp, Deepanshu Kartikey, linux-ext4, linux-kernel,
syzkaller-bugs, oliver.sang
Hello,
kernel test robot noticed "xfstests.generic.482.fail" on:
commit: a0c31dc212c0f22e40ee114504562030264e1246 ("Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero")
url: https://github.com/intel-lab-lkp/linux/commits/syzbot/Forwarded-PATCH-ext4-reject-inline-data-flag-when-i_extra_isize-is-zero/20251003-171522
base: https://git.kernel.org/cgit/linux/kernel/git/tytso/ext4.git dev
patch link: https://lore.kernel.org/all/68df92d7.050a0220.2c17c1.0020.GAE@google.com/
patch subject: Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
in testcase: xfstests
version: xfstests-x86_64-5a9cd3ef-1_20250910
with following parameters:
disk: 4HDD
fs: ext4
test: generic-482
config: x86_64-rhel-9.4-func
compiler: gcc-14
test machine: 8 threads Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz (Skylake) with 16G memory
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202510142118.8033d04d-lkp@intel.com
2025-10-09 22:02:09 cd /lkp/benchmarks/xfstests
2025-10-09 22:02:10 export TEST_DIR=/fs/sda1
2025-10-09 22:02:10 export TEST_DEV=/dev/sda1
2025-10-09 22:02:10 export FSTYP=ext4
2025-10-09 22:02:10 export SCRATCH_MNT=/fs/scratch
2025-10-09 22:02:10 mkdir /fs/scratch -p
2025-10-09 22:02:10 export SCRATCH_DEV=/dev/sda4
2025-10-09 22:02:10 export LOGWRITES_DEV=/dev/sda2
2025-10-09 22:02:10 echo generic/482
2025-10-09 22:02:10 ./check -E tests/exclude/ext4 generic/482
FSTYP -- ext4
PLATFORM -- Linux/x86_64 lkp-skl-d07 6.17.0-rc4-00019-ga0c31dc212c0 #1 SMP PREEMPT_DYNAMIC Fri Oct 10 05:40:27 CST 2025
MKFS_OPTIONS -- -F /dev/sda4
MOUNT_OPTIONS -- -o acl,user_xattr /dev/sda4 /fs/scratch
generic/482 [failed, exit status 1]- output mismatch (see /lkp/benchmarks/xfstests/results//generic/482.out.bad)
--- tests/generic/482.out 2025-09-10 01:40:16.000000000 +0000
+++ /lkp/benchmarks/xfstests/results//generic/482.out.bad 2025-10-09 22:03:12.185850079 +0000
@@ -1,2 +1,3 @@
QA output created by 482
-Silence is golden
+_check_generic_filesystem: filesystem on /dev/mapper/thin-vol.482 is inconsistent
+(see /lkp/benchmarks/xfstests/results//generic/482.full for details)
...
(Run 'diff -u /lkp/benchmarks/xfstests/tests/generic/482.out /lkp/benchmarks/xfstests/results//generic/482.out.bad' to see the entire diff)
Ran: generic/482
Failures: generic/482
Failed 1 of 1 tests
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20251014/202510142118.8033d04d-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 24+ messages in thread
* Forwarded: potential fix
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (17 preceding siblings ...)
2025-10-03 9:09 ` syzbot
@ 2025-11-08 5:34 ` syzbot
2025-11-08 17:54 ` Forwarded: test fix syzbot
` (2 subsequent siblings)
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-11-08 5:34 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: potential fix
Author: rpthibeault@gmail.com
#syz test
^ permalink raw reply [flat|nested] 24+ messages in thread* Forwarded: test fix
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (18 preceding siblings ...)
2025-11-08 5:34 ` Forwarded: potential fix syzbot
@ 2025-11-08 17:54 ` syzbot
2025-11-13 22:29 ` syzbot
2025-11-14 0:13 ` syzbot
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-11-08 17:54 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: test fix
Author: rpthibeault@gmail.com
#syz test
^ permalink raw reply [flat|nested] 24+ messages in thread* Forwarded: test fix
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (19 preceding siblings ...)
2025-11-08 17:54 ` Forwarded: test fix syzbot
@ 2025-11-13 22:29 ` syzbot
2025-11-14 0:13 ` syzbot
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-11-13 22:29 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: test fix
Author: rpthibeault@gmail.com
#syz test
^ permalink raw reply [flat|nested] 24+ messages in thread* Forwarded: test fix
2025-10-02 0:10 [syzbot] [ext4?] KASAN: slab-out-of-bounds Read in ext4_search_dir syzbot
` (20 preceding siblings ...)
2025-11-13 22:29 ` syzbot
@ 2025-11-14 0:13 ` syzbot
21 siblings, 0 replies; 24+ messages in thread
From: syzbot @ 2025-11-14 0:13 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: test fix
Author: rpthibeault@gmail.com
#syz test
^ permalink raw reply [flat|nested] 24+ messages in thread