From 2c3447a9c4fe17c713c014f79d2df485f3829c0e Mon Sep 17 00:00:00 2001 From: Yun Zhou Date: Fri, 24 Jul 2026 18:02:55 +0800 Subject: [PATCH] ext4: validate EA inode i_nlink in ext4_xattr_inode_iget Validate EA inode state in ext4_xattr_inode_iget() to reject corrupted EA inodes early, before they trigger WARN_ONCE in ext4_xattr_inode_update_ref(). When a corrupted ext4 image has an EA inode with inconsistent i_nlink and ref_count values (e.g. i_nlink=65535), the code currently allows it through and later hits WARN_ONCE when ref_count transitions cross the 0/1 boundary. This is better handled as an early sanity check that returns -EFSCORRUPTED, consistent with how ext4 treats other on-disk corruption. Since ext4_xattr_inode_iget() resolves references from active xattr entries, the target EA inode must be in active state (i_nlink=1, ref_count>0). Reject any inode that does not satisfy this. Reported-by: syzbot+76916a45d2294b551fd9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=76916a45d2294b551fd9 Fixes: dec214d00e0d ("ext4: xattr inode deduplication") Signed-off-by: Yun Zhou Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260724100255.144768-1-yun.zhou@windriver.com Signed-off-by: Theodore Ts'o --- fs/ext4/xattr.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 2e724beced11..b6304ad50899 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -460,6 +460,21 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino, inode_unlock(inode); } + /* + * Since this function resolves references from active xattr entries, + * the EA inode must be in active state (i_nlink=1, ref_count>0). + * i_nlink > 1, i_nlink == 0 (dangling reference), or ref_count == 0 + * (inconsistent with an active entry) all indicate on-disk corruption. + */ + if (inode->i_nlink != 1 || !ext4_xattr_inode_get_ref(inode)) { + ext4_error(parent->i_sb, + "EA inode %lu has unexpected i_nlink=%u ref_count=%llu", + ea_ino, inode->i_nlink, + ext4_xattr_inode_get_ref(inode)); + ext4_put_ea_inode(inode); + return -EFSCORRUPTED; + } + *ea_inode = inode; return 0; }