[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20251007234221.28643-2-eraykrdg1@gmail.com>
Date: Wed, 8 Oct 2025 02:42:22 +0300
From: Ahmet Eray Karadag <eraykrdg1@...il.com>
To: tytso@....edu,
adilger.kernel@...ger.ca
Cc: linux-ext4@...r.kernel.org,
linux-kernel@...r.kernel.org,
david.hunter.linux@...il.com,
skhan@...uxfoundation.org,
Ahmet Eray Karadag <eraykrdg1@...il.com>,
syzbot+f3185be57d7e8dda32b8@...kaller.appspotmail.com,
Albin Babu Varghese <albinbabuvarghese20@...il.com>
Subject: [PATCH] Fix: ext4: add sanity check for inode inline write range
Add a simple check in ext4_try_to_write_inline_data() to prevent
writes that extend past the inode's inline data area. The function
now returns -EINVAL if pos + len exceeds i_inline_size.
This avoids invalid inline write attempts and keeps the write path
consistent with the inode limits.
Reported-by: syzbot+f3185be57d7e8dda32b8@...kaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=f3185be57d7e8dda32b8
Co-developed-by: Albin Babu Varghese <albinbabuvarghese20@...il.com>
Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@...il.com>
Signed-off-by: Ahmet Eray Karadag <eraykrdg1@...il.com>
---
fs/ext4/inline.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 1b094a4f3866..13ba56e8e334 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -782,6 +782,16 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
struct ext4_iloc iloc;
int ret = 0, ret2;
+ if ((pos + len) > EXT4_I(inode)->i_inline_size) {
+ ext4_warning_inode(inode,
+ "inline write beyond capacity (pos=%lld, len=%u, inline_size=%d)",
+ pos, len, EXT4_I(inode)->i_inline_size);
+ folio_unlock(folio);
+ folio_put(folio);
+ ret = -EINVAL;
+ goto out;
+ }
+
if (unlikely(copied < len) && !folio_test_uptodate(folio))
copied = 0;
@@ -838,8 +848,8 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
*/
if (pos + len > inode->i_size && ext4_can_truncate(inode))
ext4_orphan_add(handle, inode);
-
- ret2 = ext4_journal_stop(handle);
+ if (handle)
+ ret2 = ext4_journal_stop(handle);
if (!ret)
ret = ret2;
if (pos + len > inode->i_size) {
--
2.43.0
Powered by blists - more mailing lists