Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ocfs2: validate cl_bpc in allocator inodes to prevent divide-by-zero

The chain allocator field cl_bpc (blocks per cluster) is read from disk
and used in division operations without validation. A corrupted
filesystem image with cl_bpc=0 causes a divide-by-zero crash in the
kernel:

divide error: 0000 [#1] PREEMPT SMP KASAN
RIP: 0010:ocfs2_bg_discontig_add_extent fs/ocfs2/suballoc.c:335 [inline]
RIP: 0010:ocfs2_block_group_fill+0x5bd/0xa70 fs/ocfs2/suballoc.c:386
Call Trace:
ocfs2_block_group_alloc+0x7e9/0x1330 fs/ocfs2/suballoc.c:703
ocfs2_reserve_suballoc_bits+0x20a6/0x4640 fs/ocfs2/suballoc.c:834
ocfs2_reserve_new_inode+0x4f4/0xcc0 fs/ocfs2/suballoc.c:1074
ocfs2_mknod+0x83c/0x2050 fs/ocfs2/namei.c:306

This patch adds validation in ocfs2_validate_inode_block() to ensure
cl_bpc matches the expected value calculated from the superblock's cluster
size and block size for chain allocator inodes (identified by
OCFS2_CHAIN_FL).

Moving the validation to inode validation time (rather than allocation time)
has several benefits:
- Validates once when the inode is read, rather than on every allocation
- Protects all code paths that use cl_bpc (allocation, resize, etc.)
- Follows the existing pattern of inode validation in OCFS2
- Centralizes validation logic

The validation catches both:
- Zero values that cause divide-by-zero crashes
- Non-zero but incorrect values indicating filesystem corruption or
mismatched filesystem geometry

With this fix, mounting a corrupted filesystem produces:

OCFS2: ERROR (device loop0): ocfs2_validate_inode_block: Inode 74
has corrupted cl_bpc: ondisk=0 expected=16

instead of a kernel crash.

[dmantipov@yandex.ru: combine into the series and tweak the message to fit the commonly used style]
Link: https://lkml.kernel.org/r/20251030153003.1934585-2-dmantipov@yandex.ru
Link: https://lore.kernel.org/ocfs2-devel/20251026132625.12348-1-kartikey406@gmail.com/T/#u [v1]
Link: https://lore.kernel.org/all/20251027124131.10002-1-kartikey406@gmail.com/T/ [v2]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Reported-by: syzbot+fd8af97c7227fe605d95@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fd8af97c7227fe605d95
Tested-by: syzbot+fd8af97c7227fe605d95@syzkaller.appspotmail.com
Suggested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Deepanshu Kartikey and committed by
Andrew Morton
93ce0ff1 e1c70505

+10
+10
fs/ocfs2/inode.c
··· 1515 1515 1516 1516 if (le32_to_cpu(di->i_flags) & OCFS2_CHAIN_FL) { 1517 1517 struct ocfs2_chain_list *cl = &di->id2.i_chain; 1518 + u16 bpc = 1 << (OCFS2_SB(sb)->s_clustersize_bits - 1519 + sb->s_blocksize_bits); 1518 1520 1519 1521 if (le16_to_cpu(cl->cl_count) != ocfs2_chain_recs_per_inode(sb)) { 1520 1522 rc = ocfs2_error(sb, "Invalid dinode %llu: chain list count %u\n", ··· 1528 1526 rc = ocfs2_error(sb, "Invalid dinode %llu: chain list index %u\n", 1529 1527 (unsigned long long)bh->b_blocknr, 1530 1528 le16_to_cpu(cl->cl_next_free_rec)); 1529 + goto bail; 1530 + } 1531 + if (OCFS2_SB(sb)->bitmap_blkno && 1532 + OCFS2_SB(sb)->bitmap_blkno != le64_to_cpu(di->i_blkno) && 1533 + le16_to_cpu(cl->cl_bpc) != bpc) { 1534 + rc = ocfs2_error(sb, "Invalid dinode %llu: bits per cluster %u\n", 1535 + (unsigned long long)bh->b_blocknr, 1536 + le16_to_cpu(cl->cl_bpc)); 1531 1537 goto bail; 1532 1538 } 1533 1539 }