linux-kernel - Re: [PATCH v2] Fix: ext4: guard against EA inode refcount underflow in xattr update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <175892300646.128029.18166257596583769324.b4-ty@mit.edu>
Date: Fri, 26 Sep 2025 17:47:35 -0400
From: "Theodore Ts'o" <tytso@....edu>
To: adilger.kernel@...ger.ca, Ahmet Eray Karadag <eraykrdg1@...il.com>
Cc: "Theodore Ts'o" <tytso@....edu>, linux-ext4@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        syzbot+0be4f339a8218d2a5bb1@...kaller.appspotmail.com,
        Albin Babu Varghese <albinbabuvarghese20@...il.com>
Subject: Re: [PATCH v2] Fix: ext4: guard against EA inode refcount underflow in xattr update


On Sat, 20 Sep 2025 05:13:43 +0300, Ahmet Eray Karadag wrote:
> syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA
> inode refcount that is already <= 0 and then applies ref_change (often
> -1). That lets the refcount underflow and we proceed with a bogus value,
> triggering errors like:
> 
>   EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1
>   EXT4-fs warning: ea_inode dec ref err=-117
> 
> [...]

Applied, thanks!

[1/1] Fix: ext4: guard against EA inode refcount underflow in xattr update
      commit: 57295e835408d8d425bef58da5253465db3d6888

Best regards,
-- 
Theodore Ts'o <tytso@....edu>