[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <68df4011.050a0220.1696c6.003d.GAE@google.com>
Date: Thu, 02 Oct 2025 20:16:33 -0700
From: syzbot <syzbot+3ee481e21fd75e14c397@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] ext4: reject inline data flag when i_extra_isize
is zero
For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.
***
Subject: [PATCH] ext4: reject inline data flag when i_extra_isize is zero
Author: kartikey406@...il.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Prevent use-after-free in ext4_search_dir by rejecting inodes that claim to
have inline data but have no extra inode space allocated. ext4 inline data is
stored in the extra inode space beyond the standard 128-byte inode structure.
This requires i_extra_isize to be non-zero to provide space for the
system.data xattr that stores the inline directory entries or file data.
However, a corrupted filesystem can craft an inode with both: - i_extra_isize
== 0 (no extra space) - EXT4_INODE_INLINE_DATA flag set (claims to use extra
space) This creates a fundamental inconsistency. When i_extra_isize is zero,
ext4_iget() skips calling ext4_iget_extra_inode(), which means the inline
xattr validation in check_xattrs() never runs. Later, when
ext4_find_inline_entry() attempts to access the inline data, it reads
unvalidated and potentially corrupt xattr structures, leading to
out-of-bounds memory access and use-after-free. Fix this by validating in
ext4_iget() that if an inode has the EXT4_INODE_INLINE_DATA flag set,
i_extra_isize must be non-zero. This catches the corruption at inode load
time before any inline data operations are attempted.
Reported-by: syzbot+3ee481e21fd75e14c397@...kaller.appspotmail.com
Closes:https://syzkaller.appspot.com/bug?extid=3ee481e21fd75e14c397
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
fs/ext4/inline.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 1b094a4f3866..d6541e661dfa 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -1614,9 +1614,19 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,
if (ext4_get_inline_size(dir) == EXT4_MIN_INLINE_DATA_SIZE)
goto out;
-
+
inline_start = ext4_get_inline_xattr_pos(dir, &is.iloc);
inline_size = ext4_get_inline_size(dir) - EXT4_MIN_INLINE_DATA_SIZE;
+ void *inode_start = ext4_raw_inode(&is.iloc);
+ void *inode_end = inode_start + EXT4_INODE_SIZE(dir->i_sb);
+
+ if (inline_start < inode_start ||
+ inline_start >= inode_end ||
+ inline_start + inline_size > inode_end) {
+ printk(KERN_WARNING "found error in ext4_find_inline_entry\n");
+ ret = -EFSCORRUPTED;
+ goto out;
+ }
ret = ext4_search_dir(is.iloc.bh, inline_start, inline_size,
dir, fname, 0, res_dir);
--
2.43.0
Powered by blists - more mailing lists