[PATCH 6.6.y] ocfs2: add extra consistency checks for chain allocator dinodes

[PATCH 6.6.y] ocfs2: add extra consistency checks for chain allocator dinodes

[driz2t]

[-- Attachment #1.1: Type: text/plain, Size: 194 bytes --]

Hi,

Please test this patch on stable 6.6.y.


#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git c09fbcd31ae6d71e7c69545839bec92d8e15c13b


Thanks,
Changjian Liu

[-- Attachment #1.2: Type: text/html, Size: 269 bytes --]

[-- Attachment #2: 1dd53396e7124586dca9.patch --]
[-- Type: application/octet-stream, Size: 2139 bytes --]

commit e1c70505ee8158c1108340d9cd67182ade93af4a
Author: Dmitry Antipov <dmantipov@yandex.ru>
Date:   Thu Oct 30 18:30:02 2025 +0300

    ocfs2: add extra consistency checks for chain allocator dinodes
    
    When validating chain allocator dinode in 'ocfs2_validate_inode_block()',
    add an extra checks whether a) the maximum amount of chain records in
    'struct ocfs2_chain_list' matches the value calculated based on the
    filesystem block size, and b) the next free slot index is within the valid
    range.
    
    Link: https://lkml.kernel.org/r/20251030153003.1934585-1-dmantipov@yandex.ru
    Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
    Reported-by: syzbot+77026564530dbc29b854@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=77026564530dbc29b854
    Reported-by: syzbot+5054473a31f78f735416@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=5054473a31f78f735416
    Suggested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
    Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
    Cc: Junxiao Bi <junxiao.bi@oracle.com>
    Cc: Jun Piao <piaojun@huawei.com>
    Cc: Deepanshu Kartikey <kartikey406@gmail.com>
    Cc: Heming Zhao <heming.zhao@suse.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Mark Fasheh <mark@fasheh.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -1513,6 +1513,23 @@ int ocfs2_validate_inode_block(struct super_block *sb,
 		goto bail;
 	}
 
+	if (le32_to_cpu(di->i_flags) & OCFS2_CHAIN_FL) {
+		struct ocfs2_chain_list *cl = &di->id2.i_chain;
+
+		if (le16_to_cpu(cl->cl_count) != ocfs2_chain_recs_per_inode(sb)) {
+			rc = ocfs2_error(sb, "Invalid dinode %llu: chain list count %u\n",
+					 (unsigned long long)bh->b_blocknr,
+					 le16_to_cpu(cl->cl_count));
+			goto bail;
+		}
+		if (le16_to_cpu(cl->cl_next_free_rec) > le16_to_cpu(cl->cl_count)) {
+			rc = ocfs2_error(sb, "Invalid dinode %llu: chain list index %u\n",
+					 (unsigned long long)bh->b_blocknr,
+					 le16_to_cpu(cl->cl_next_free_rec));
+			goto bail;
+		}
+	}
+
 	rc = 0;
 
 bail:

[PATCH 6.6.y] ocfs2: add extra consistency checks for chain allocator dinodes

[Changjian Liu]

[ Upstream commit e1c70505ee8158c1108340d9cd67182ade93af4a ]

ocfs2: add extra consistency checks for chain allocator dinodes

When validating chain allocator dinode in 'ocfs2_validate_inode_block()',
add an extra checks whether a) the maximum amount of chain records in
'struct ocfs2_chain_list' matches the value calculated based on the
filesystem block size, and b) the next free slot index is within the valid
range.

Link: https://lkml.kernel.org/r/20251030153003.1934585-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Reported-by: syzbot+77026564530dbc29b854@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=77026564530dbc29b854
Reported-by: syzbot+5054473a31f78f735416@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5054473a31f78f735416
Suggested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Deepanshu Kartikey <kartikey406@gmail.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mark@fasheh.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Changjian Liu <driz2t@qq.com>
---
 fs/ocfs2/inode.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index c561a8a6493e..7c99f436037b 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -1419,6 +1419,23 @@ int ocfs2_validate_inode_block(struct super_block *sb,
 		goto bail;
 	}
 
+	if (le32_to_cpu(di->i_flags) & OCFS2_CHAIN_FL) {
+		struct ocfs2_chain_list *cl = &di->id2.i_chain;
+
+		if (le16_to_cpu(cl->cl_count) != ocfs2_chain_recs_per_inode(sb)) {
+			rc = ocfs2_error(sb, "Invalid dinode %llu: chain list count %u\n",
+					 (unsigned long long)bh->b_blocknr,
+					 le16_to_cpu(cl->cl_count));
+			goto bail;
+		}
+		if (le16_to_cpu(cl->cl_next_free_rec) > le16_to_cpu(cl->cl_count)) {
+			rc = ocfs2_error(sb, "Invalid dinode %llu: chain list index %u\n",
+					 (unsigned long long)bh->b_blocknr,
+					 le16_to_cpu(cl->cl_next_free_rec));
+			goto bail;
+		}
+	}
+
 	rc = 0;
 
 bail:
-- 
2.43.0

Re: [PATCH 6.6.y] ocfs2: add extra consistency checks for chain allocator dinodes

[Greg KH]

On Sun, Mar 29, 2026 at 05:13:52PM +0800, Changjian Liu wrote:
> [ Upstream commit e1c70505ee8158c1108340d9cd67182ade93af4a ]
> 
> ocfs2: add extra consistency checks for chain allocator dinodes

For some reason you did not address my previous review comments, so I'm
going to have to delete this and ignore future submissions until you
work with someone who can help you with the development process and will
submit changes that they have approved first.

sorry,

greg k-h