github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 20:54:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ext4: validate EA inode i_nlink in ext4_xattr_inode_iget

Browse Source 
Validate EA inode state in ext4_xattr_inode_iget() to reject corrupted
EA inodes early, before they trigger WARN_ONCE in
ext4_xattr_inode_update_ref().

When a corrupted ext4 image has an EA inode with inconsistent i_nlink
and ref_count values (e.g. i_nlink=65535), the code currently allows it
through and later hits WARN_ONCE when ref_count transitions cross the
0/1 boundary.  This is better handled as an early sanity check that
returns -EFSCORRUPTED, consistent with how ext4 treats other on-disk
corruption.

Since ext4_xattr_inode_iget() resolves references from active xattr
entries, the target EA inode must be in active state (i_nlink=1,
ref_count>0).  Reject any inode that does not satisfy this.

Reported-by: syzbot+76916a45d2294b551fd9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=76916a45d2294b551fd9
Fixes: dec214d00e ("ext4: xattr inode deduplication")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260724100255.144768-1-yun.zhou@windriver.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
This commit is contained in:
Yun Zhou 2026-07-24 18:02:55 +08:00 committed by Theodore Ts'o
parent 97e211ad1a
commit 2c3447a9c4
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
fs/ext4/xattr.c
View File

@ -460,6 +460,21 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,
inode_unlock(inode);
}
/*
* Since this function resolves references from active xattr entries,
* the EA inode must be in active state (i_nlink=1, ref_count>0).
* i_nlink > 1, i_nlink == 0 (dangling reference), or ref_count == 0
* (inconsistent with an active entry) all indicate on-disk corruption.
*/
if (inode->i_nlink != 1 || !ext4_xattr_inode_get_ref(inode)) {
ext4_error(parent->i_sb,
"EA inode %lu has unexpected i_nlink=%u ref_count=%llu",
ea_ino, inode->i_nlink,
ext4_xattr_inode_get_ref(inode));
ext4_put_ea_inode(inode);
return -EFSCORRUPTED;
}
*ea_inode = inode;
return 0;
}