Evolution-X-Devices/kernel_xiaomi_garnet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr

Browse Source 
[ Upstream commit 099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42 ]

A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data()
when an inode had the INLINE_DATA_FL flag set but was missing the
system.data extended attribute.

Since this can happen due to a maiciouly fuzzed file system, we
shouldn't BUG, but rather, report it as a corrupted file system.

Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii
ext4_create_inline_data() and ext4_inline_data_truncate().

Reported-by: syzbot+544248a761451c0df72f@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Theodore Ts'o
2025-07-17 10:54:34 -04:00
committed by Greg Kroah-Hartman
parent a4dc000de7
commit 1199a63998
1 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
fs/ext4/inline.c
View File

@@ -296,7 +296,11 @@ static int ext4_create_inline_data(handle_t *handle,
if (error)
goto out;
BUG_ON(!is.s.not_found);
if (!is.s.not_found) {
EXT4_ERROR_INODE(inode, "unexpected inline data xattr");
error = -EFSCORRUPTED;
goto out;
}
error = ext4_xattr_ibody_set(handle, inode, &i, &is);
if (error) {
@@ -347,7 +351,11 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode,
if (error)
goto out;
BUG_ON(is.s.not_found);
if (is.s.not_found) {
EXT4_ERROR_INODE(inode, "missing inline data xattr");
error = -EFSCORRUPTED;
goto out;
}
len -= EXT4_MIN_INLINE_DATA_SIZE;
value = kzalloc(len, GFP_NOFS);
@@ -1939,7 +1947,12 @@ int ext4_inline_data_truncate(struct inode *inode, int *has_inline)
if ((err = ext4_xattr_ibody_find(inode, &i, &is)) != 0)
goto out_error;
BUG_ON(is.s.not_found);
if (is.s.not_found) {
EXT4_ERROR_INODE(inode,
"missing inline data xattr");
err = -EFSCORRUPTED;
goto out_error;
}
value_len = le32_to_cpu(is.s.here->e_value_size);
value = kmalloc(value_len, GFP_NOFS);