[PATCH] ext4: validate inode block references during fast commit replay

[PATCH] ext4: validate inode block references during fast commit replay

[Hamza Mahfooz]

__ext4_iget() currently skips ext4_ext_check_inode() and
ext4_ind_check_inode() when EXT4_FC_REPLAY is set in s_mount_state.
As a result, an extent-mapped inode loaded from disk during fast commit
replay never has its in-inode extent header or root extent entries
validated before replay paths such as ext4_fc_replay_inode() and
ext4_fc_replay_add_range() walk or modify i_data[].

A crafted filesystem image with a fast commit journal and an inode whose
eh_max / eh_entries exceed the four-extent capacity of i_data[] triggers
slab-out-of-bounds reads in ext4_cache_extents() and slab-out-of-bounds
writes in ext4_ext_insert_extent() into adjacent fields of struct
ext4_inode_info and beyond the ext4_inode_cache slab allocation.

ext4_ext_check_inode() and ext4_ind_check_inode() only validate the
in-inode extent header and check block numbers against static superblock
bounds via ext4_inode_block_valid(), not block allocation bitmaps. So,
drop the EXT4_FC_REPLAY exemption in __ext4_iget() so inodes read during
fast commit replay are validated.

Cc: stable@vger.kernel.org
Reported-by: Simon Brakhane <simon@brakhane.net>
Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
---
 fs/ext4/inode.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 26f0f9714f03..cf74c5014fa7 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5582,10 +5582,9 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
 		goto bad_inode;
 	} else if (!ext4_has_inline_data(inode)) {
 		/* validate the block references in the inode */
-		if (!(EXT4_SB(sb)->s_mount_state & EXT4_FC_REPLAY) &&
-			(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
-			(S_ISLNK(inode->i_mode) &&
-			!ext4_inode_is_fast_symlink(inode)))) {
+		if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
+		    (S_ISLNK(inode->i_mode) &&
+		     !ext4_inode_is_fast_symlink(inode))) {
 			if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
 				ret = ext4_ext_check_inode(inode);
 			else
-- 
2.56.0

Re: [PATCH] ext4: validate inode block references during fast commit replay

[Hamza Mahfooz]

On Mon, Oct 26, 2026 at 12:48:53PM -0400, Hamza Mahfooz wrote:
> __ext4_iget() currently skips ext4_ext_check_inode() and
> ext4_ind_check_inode() when EXT4_FC_REPLAY is set in s_mount_state.
> As a result, an extent-mapped inode loaded from disk during fast commit
> replay never has its in-inode extent header or root extent entries
> validated before replay paths such as ext4_fc_replay_inode() and
> ext4_fc_replay_add_range() walk or modify i_data[].
> 
> A crafted filesystem image with a fast commit journal and an inode whose
> eh_max / eh_entries exceed the four-extent capacity of i_data[] triggers
> slab-out-of-bounds reads in ext4_cache_extents() and slab-out-of-bounds
> writes in ext4_ext_insert_extent() into adjacent fields of struct
> ext4_inode_info and beyond the ext4_inode_cache slab allocation.
> 
> ext4_ext_check_inode() and ext4_ind_check_inode() only validate the
> in-inode extent header and check block numbers against static superblock
> bounds via ext4_inode_block_valid(), not block allocation bitmaps. So,
> drop the EXT4_FC_REPLAY exemption in __ext4_iget() so inodes read during
> fast commit replay are validated.
> 

Ping?

> Cc: stable@vger.kernel.org
> Reported-by: Simon Brakhane <simon@brakhane.net>
> Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
> Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
> ---
>  fs/ext4/inode.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index 26f0f9714f03..cf74c5014fa7 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -5582,10 +5582,9 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
>  		goto bad_inode;
>  	} else if (!ext4_has_inline_data(inode)) {
>  		/* validate the block references in the inode */
> -		if (!(EXT4_SB(sb)->s_mount_state & EXT4_FC_REPLAY) &&
> -			(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
> -			(S_ISLNK(inode->i_mode) &&
> -			!ext4_inode_is_fast_symlink(inode)))) {
> +		if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
> +		    (S_ISLNK(inode->i_mode) &&
> +		     !ext4_inode_is_fast_symlink(inode))) {
>  			if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
>  				ret = ext4_ext_check_inode(inode);
>  			else
> -- 
> 2.56.0