[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20251008004717.GL8084@frogsfrogsfrogs>
Date: Tue, 7 Oct 2025 17:47:17 -0700
From: "Darrick J. Wong" <djwong@...nel.org>
To: Ahmet Eray Karadag <eraykrdg1@...il.com>
Cc: tytso@....edu, adilger.kernel@...ger.ca, linux-ext4@...r.kernel.org,
linux-kernel@...r.kernel.org, david.hunter.linux@...il.com,
skhan@...uxfoundation.org,
syzbot+f3185be57d7e8dda32b8@...kaller.appspotmail.com,
Albin Babu Varghese <albinbabuvarghese20@...il.com>
Subject: Re: [PATCH] Fix: ext4: add sanity check for inode inline write range
On Wed, Oct 08, 2025 at 02:42:22AM +0300, Ahmet Eray Karadag wrote:
> Add a simple check in ext4_try_to_write_inline_data() to prevent
> writes that extend past the inode's inline data area. The function
> now returns -EINVAL if pos + len exceeds i_inline_size.
>
> This avoids invalid inline write attempts and keeps the write path
> consistent with the inode limits.
>
> Reported-by: syzbot+f3185be57d7e8dda32b8@...kaller.appspotmail.com
> Link: https://syzkaller.appspot.com/bug?extid=f3185be57d7e8dda32b8
> Co-developed-by: Albin Babu Varghese <albinbabuvarghese20@...il.com>
> Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@...il.com>
> Signed-off-by: Ahmet Eray Karadag <eraykrdg1@...il.com>
> ---
> fs/ext4/inline.c | 14 ++++++++++++--
> 1 file changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
> index 1b094a4f3866..13ba56e8e334 100644
> --- a/fs/ext4/inline.c
> +++ b/fs/ext4/inline.c
> @@ -782,6 +782,16 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
> struct ext4_iloc iloc;
> int ret = 0, ret2;
>
> + if ((pos + len) > EXT4_I(inode)->i_inline_size) {
> + ext4_warning_inode(inode,
> + "inline write beyond capacity (pos=%lld, len=%u, inline_size=%d)",
> + pos, len, EXT4_I(inode)->i_inline_size);
> + folio_unlock(folio);
> + folio_put(folio);
> + ret = -EINVAL;
> + goto out;
Shouldn't write_begin have converted the file to block format if the
range to be written exceeds the possible inlinedata size?
> + }
> +
> if (unlikely(copied < len) && !folio_test_uptodate(folio))
> copied = 0;
>
> @@ -838,8 +848,8 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
> */
> if (pos + len > inode->i_size && ext4_can_truncate(inode))
> ext4_orphan_add(handle, inode);
> -
> - ret2 = ext4_journal_stop(handle);
> + if (handle)
> + ret2 = ext4_journal_stop(handle);
What is this??
--D
> if (!ret)
> ret = ret2;
> if (pos + len > inode->i_size) {
> --
> 2.43.0
>
>
Powered by blists - more mailing lists