linux-kernel - [PATCH] ext4: fix unaligned preallocation with bigalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251121002209.416949-2-eraykrdg1@gmail.com>
Date: Fri, 21 Nov 2025 03:22:10 +0300
From: Ahmet Eray Karadag <eraykrdg1@...il.com>
To: tytso@....edu,
	adilger.kernel@...ger.ca
Cc: linux-ext4@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	david.hunter.linux@...il.com,
	skhan@...uxfoundation.org,
	Ahmet Eray Karadag <eraykrdg1@...il.com>,
	syzbot+ee60e584b5c6bb229126@...kaller.appspotmail.com,
	Albin Babu Varghese <albinbabuvarghese20@...il.com>
Subject: [PATCH] ext4: fix unaligned preallocation with bigalloc

Syzkaller reported a use-after-free in ext4_find_extent() when using
bigalloc. The crash occurs during the extent tree traversal when the
system tries to access a freed extent path.

The root cause is related to how the multi-block allocator (mballoc)
handles alignment in bigalloc filesystems (s_cluster_ratio > 1).
When a request for a block is made, mballoc might return a goal start
block that is not aligned to the cluster boundary (e.g., block 1 instead
of 0) because the cluster start is busy.

Previously, ext4_mb_new_inode_pa() and ext4_mb_new_group_pa() did not
strictly enforce cluster alignment or handle collisions where aligning
down would overlap with busy space. This resulted in the creation of
Preallocation (PA) extents that started in the middle of a cluster.
This misalignment causes metadata inconsistency between the physical
allocation (bitmap) and the logical extent tree, eventually leading to
a use-after-free during inode eviction or truncation.

This patch fixes the issue by enforcing strict cluster alignment for
both inode and group preallocations.

Using AC_STATUS_BREAK ensures that we do not manually free the PA
(avoiding double-free bugs in the caller's cleanup path) and allows
the allocator to find a more suitable block group.

Tested with kvm-xfstests -c bigalloc_4k -g quick, no regressions found.

Reported-by: syzbot+ee60e584b5c6bb229126@...kaller.appspotmail.com
Fixes: https://syzkaller.appspot.com/bug?extid=ee60e584b5c6bb229126
Co-developed-by: Albin Babu Varghese <albinbabuvarghese20@...il.com>
Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@...il.com>
Signed-off-by: Ahmet Eray Karadag <eraykrdg1@...il.com>
---
 fs/ext4/mballoc.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 9087183602e4..549d6cf58f3c 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -5291,6 +5291,21 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)

 		ex.fe_logical = ac->ac_o_ex.fe_logical;
 adjust_bex:
+		if (sbi->s_cluster_ratio > 1) {
+			loff_t mask = ~(sbi->s_cluster_ratio - 1);
+			loff_t aligned_start = ex.fe_logical & mask;
+
+			if (aligned_start < ac->ac_g_ex.fe_logical) {
+				ac->ac_status = AC_STATUS_BREAK;
+				return;
+			}
+
+			ex.fe_len += (ex.fe_logical - aligned_start);
+			ex.fe_logical = aligned_start;
+
+			if (ex.fe_logical + ex.fe_len > orig_goal_end)
+				ex.fe_len = orig_goal_end - ex.fe_logical;
+		}
 		ac->ac_b_ex.fe_logical = ex.fe_logical;

 		BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical);
@@ -5336,6 +5351,7 @@ static noinline_for_stack void
 ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
 {
 	struct super_block *sb = ac->ac_sb;
+	struct ext4_sb_info *sbi = EXT4_SB(sb);
 	struct ext4_locality_group *lg;
 	struct ext4_prealloc_space *pa;
 	struct ext4_group_info *grp;
@@ -5347,7 +5363,15 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
 	BUG_ON(ac->ac_pa == NULL);

 	pa = ac->ac_pa;
+	if (sbi->s_cluster_ratio > 1) {
+		loff_t mask = ~(sbi->s_cluster_ratio - 1);
+		loff_t pstart = ext4_grp_offs_to_block(sb, &ac->ac_b_ex);

+		if ((pstart & mask) < pstart) {
+			ac->ac_status = AC_STATUS_BREAK;
+			return;
+		}
+	}
 	pa->pa_pstart = ext4_grp_offs_to_block(sb, &ac->ac_b_ex);
 	pa->pa_lstart = pa->pa_pstart;
 	pa->pa_len = ac->ac_b_ex.fe_len;
-- 
2.43.0