linux-kernel - Forwarded: [PATCH] ext4: validate inline data flag is consistent with inode size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6981a94c.050a0220.3b3015.0008.GAE@google.com>
Date: Mon, 02 Feb 2026 23:52:44 -0800
From: syzbot <syzbot+7de5fe447862fc37576f@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] ext4: validate inline data flag is consistent with
 inode size

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] ext4: validate inline data flag is consistent with inode size
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Add validation in ext4_iget() to detect corrupted inodes that have
the EXT4_INLINE_DATA_FL flag set but have a file size that exceeds
the inline data capacity.

Inline data in ext4 is stored in the inode's i_block array (60 bytes)
and extended attribute space (typically up to 100 bytes), with a
practical maximum of around 156 bytes. However, corrupted or
maliciously crafted filesystem images can have inodes with the inline
data flag set but claiming much larger sizes.

This inconsistency can trigger a kernel BUG_ON() in
ext4_write_inline_data() when the filesystem attempts to write data
through the inline data path:

  kernel BUG at fs/ext4/inline.c:240!
  BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);

The crash occurs because:
1. Mount loads a corrupted inode with inline flag + large size
2. File operations like truncate() fail to convert to extent-based storage
3. Write operations (e.g., via sendfile) attempt inline data write
4. BUG_ON fires when write size exceeds actual inline capacity

This fix adds a check in ext4_iget() using a conservative 512 byte
limit. Any inode with the inline data flag but size exceeding this
limit is rejected with -EFSCORRUPTED, preventing the crash and
failing gracefully at mount time rather than during file operations.

The 512 byte threshold provides safety margin above the realistic
maximum inline size while catching corruption cases like the reported
50MB file with inline flag set.

Reported-by: syzbot+7de5fe447862fc37576f@...kaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=7de5fe447862fc37576f
Signed-off-by: Deepanshu Kartikey <Kartikey406@...il.com>
---
 fs/ext4/inode.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 0c466ccbed69..ed79a558b6fd 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5310,6 +5310,16 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
 		ret = -EFSCORRUPTED;
 		goto bad_inode;
 	}
+	if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA)) {
+		if (size > 512) {
+			ext4_error_inode(inode, function, line, 0,
+					 "iget: inline data flag set but size %lld exceeds capacity",
+					 size);
+			ret = -EFSCORRUPTED;
+			goto bad_inode;
+		}
+	}
+
 	inode->i_blocks = ext4_inode_blocks(raw_inode, ei);
 	ei->i_file_acl = le32_to_cpu(raw_inode->i_file_acl_lo);
 	if (ext4_has_feature_64bit(sb))
-- 
2.43.0