tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ocfs2: add extra consistency checks for chain allocator dinodes

When validating chain allocator dinode in 'ocfs2_validate_inode_block()',
add an extra checks whether a) the maximum amount of chain records in
'struct ocfs2_chain_list' matches the value calculated based on the
filesystem block size, and b) the next free slot index is within the valid
range.

Link: https://lkml.kernel.org/r/20251030153003.1934585-1-dmantipov@yandex.ru
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Reported-by: syzbot+77026564530dbc29b854@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=77026564530dbc29b854
Reported-by: syzbot+5054473a31f78f735416@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5054473a31f78f735416
Suggested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Deepanshu Kartikey <kartikey406@gmail.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mark@fasheh.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Dmitry Antipov and committed by
Andrew Morton e1c70505 91251632

+17
+17
fs/ocfs2/inode.c
··· 1513 1513 goto bail; 1514 1514 } 1515 1515 1516 + if (le32_to_cpu(di->i_flags) & OCFS2_CHAIN_FL) { 1517 + struct ocfs2_chain_list *cl = &di->id2.i_chain; 1518 + 1519 + if (le16_to_cpu(cl->cl_count) != ocfs2_chain_recs_per_inode(sb)) { 1520 + rc = ocfs2_error(sb, "Invalid dinode %llu: chain list count %u\n", 1521 + (unsigned long long)bh->b_blocknr, 1522 + le16_to_cpu(cl->cl_count)); 1523 + goto bail; 1524 + } 1525 + if (le16_to_cpu(cl->cl_next_free_rec) > le16_to_cpu(cl->cl_count)) { 1526 + rc = ocfs2_error(sb, "Invalid dinode %llu: chain list index %u\n", 1527 + (unsigned long long)bh->b_blocknr, 1528 + le16_to_cpu(cl->cl_next_free_rec)); 1529 + goto bail; 1530 + } 1531 + } 1532 + 1516 1533 rc = 0; 1517 1534 1518 1535 bail: