From nobody Thu Sep 18 09:55:23 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81C0BC352A1 for ; Wed, 7 Dec 2022 07:20:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229479AbiLGHUG (ORCPT ); Wed, 7 Dec 2022 02:20:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50578 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229718AbiLGHT4 (ORCPT ); Wed, 7 Dec 2022 02:19:56 -0500 Received: from dggsgout11.his.huawei.com (unknown [45.249.212.51]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4594F2183C; Tue, 6 Dec 2022 23:19:55 -0800 (PST) Received: from mail02.huawei.com (unknown [172.30.67.153]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTP id 4NRpZY0CBsz4f3k6P; Wed, 7 Dec 2022 15:19:49 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.127.227]) by APP4 (Coremail) with SMTP id gCh0CgBniteWPpBj6qE0Bw--.52253S5; Wed, 07 Dec 2022 15:19:52 +0800 (CST) From: Ye Bin To: tytso@mit.edu, adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org Cc: linux-kernel@vger.kernel.org, jack@suse.cz, Ye Bin , syzbot+4d99a966fd74bdeeec36@syzkaller.appspotmail.com Subject: [PATCH v2 1/6] ext4: fix WARNING in ext4_expand_extra_isize_ea Date: Wed, 7 Dec 2022 15:40:38 +0800 Message-Id: <20221207074043.1286731-2-yebin@huaweicloud.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221207074043.1286731-1-yebin@huaweicloud.com> References: <20221207074043.1286731-1-yebin@huaweicloud.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: gCh0CgBniteWPpBj6qE0Bw--.52253S5 X-Coremail-Antispam: 1UD129KBjvJXoWxGrW3JFy5KrWkJr4rZr4kXrb_yoWrKry8pw 43A347Cr48XF9rCF4xAr1Utwn8Wwn5CF4UJryxWr1kZFy3Jw1xKa98Kr4SqFyxtrW8Jry2 qFn8J34rKw15GaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvGb4IE77IF4wAFF20E14v26ryj6rWUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUGw A2048vs2IY020Ec7CjxVAFwI0_JFI_Gr1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0rcxS w2x7M28EF7xvwVC0I7IYx2IY67AKxVW7JVWDJwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxV W8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I0E14v2 6rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMc Ij6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_ Jr0_Gr1lF7xvr2IYc2Ij64vIr41l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr 0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY 17CE14v26r126r1DMIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcV C0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY 6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa 73UjIFyTuYvjxUzl1vUUUUU X-CM-SenderInfo: p1hex046kxt4xhlfz01xgou0bp/ X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Bin Syzbot found the following issue: Reported-by: syzbot+4d99a966fd74bdeeec36@syzkaller.appspotmail.com ------------[ cut here ]------------ WARNING: CPU: 1 PID: 3631 at mm/page_alloc.c:5534 __alloc_pages+0x30a/0x560= mm/page_alloc.c:5534 Modules linked in: CPU: 1 PID: 3631 Comm: syz-executor261 Not tainted 6.1.0-rc6-syzkaller-0030= 8-g644e9524388a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 10/26/2022 RIP: 0010:__alloc_pages+0x30a/0x560 mm/page_alloc.c:5534 RSP: 0018:ffffc90003ccf080 EFLAGS: 00010246 RAX: ffffc90003ccf0e0 RBX: 000000000000000c RCX: 0000000000000000 RDX: 0000000000000028 RSI: 0000000000000000 RDI: ffffc90003ccf108 RBP: ffffc90003ccf198 R08: dffffc0000000000 R09: ffffc90003ccf0e0 R10: fffff52000799e21 R11: 1ffff92000799e1c R12: 0000000000040c40 R13: 1ffff92000799e18 R14: dffffc0000000000 R15: 1ffff92000799e14 FS: 0000555555c10300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc36f70000 CR3: 00000000744ad000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __alloc_pages_node include/linux/gfp.h:223 [inline] alloc_pages_node include/linux/gfp.h:246 [inline] __kmalloc_large_node+0x8a/0x1a0 mm/slab_common.c:1096 __do_kmalloc_node mm/slab_common.c:943 [inline] __kmalloc+0xfe/0x1a0 mm/slab_common.c:968 kmalloc include/linux/slab.h:558 [inline] ext4_xattr_move_to_block fs/ext4/xattr.c:2558 [inline] ext4_xattr_make_inode_space fs/ext4/xattr.c:2673 [inline] ext4_expand_extra_isize_ea+0xe3f/0x1cd0 fs/ext4/xattr.c:2765 __ext4_expand_extra_isize+0x2b8/0x3f0 fs/ext4/inode.c:5857 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5900 [inline] __ext4_mark_inode_dirty+0x51a/0x670 fs/ext4/inode.c:5978 ext4_inline_data_truncate+0x548/0xd00 fs/ext4/inline.c:2021 ext4_truncate+0x341/0xeb0 fs/ext4/inode.c:4221 ext4_process_orphan+0x1aa/0x2d0 fs/ext4/orphan.c:339 ext4_orphan_cleanup+0xb60/0x1340 fs/ext4/orphan.c:474 __ext4_fill_super fs/ext4/super.c:5515 [inline] ext4_fill_super+0x80ed/0x8610 fs/ext4/super.c:5643 get_tree_bdev+0x400/0x620 fs/super.c:1324 vfs_get_tree+0x88/0x270 fs/super.c:1531 do_new_mount+0x289/0xad0 fs/namespace.c:3040 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Reason is allocate 16M memory by kmalloc, but MAX_ORDER is 11, kmalloc can allocate maxium size memory is 4M. XATTR_SIZE_MAX is currently 64k, but EXT4_XATTR_SIZE_MAX is '(1 << 24)', so 'ext4_xattr_check_entries()' regards this length as legal. Then trigger warning in 'ext4_xattr_move_to_block()'. To solve above issue, change EXT4_XATTR_SIZE_MAX from '(1 << 24)' to XATTR_SIZE_MAX. As VFS limit extended attribute maxium size to XATTR_SIZE_M= AX. So we can assume that there will be no extended attribute with a length gre= ater than XATTR_SIZE_MAX. Reported-by: syzbot+4d99a966fd74bdeeec36@syzkaller.appspotmail.com Fixes: 54dd0e0a1b25 ("ext4: add extra checks to ext4_xattr_block_get()") Signed-off-by: Ye Bin --- fs/ext4/xattr.h | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h index 824faf0b15a8..c71e582b1007 100644 --- a/fs/ext4/xattr.h +++ b/fs/ext4/xattr.h @@ -71,15 +71,10 @@ struct ext4_xattr_entry { #define IFIRST(hdr) ((struct ext4_xattr_entry *)((hdr)+1)) =20 /* - * XATTR_SIZE_MAX is currently 64k, but for the purposes of checking - * for file system consistency errors, we use a somewhat bigger value. - * This allows XATTR_SIZE_MAX to grow in the future, but by using this - * instead of INT_MAX for certain consistency checks, we don't need to - * worry about arithmetic overflows. (Actually XATTR_SIZE_MAX is - * defined in include/uapi/linux/limits.h, so changing it is going - * not going to be trivial....) + * Use XATTR_SIZE_MAX to checking for file system consistency errors. Exte= nded + * attribute length exceed XATTR_SIZE_MAX is illegal. */ -#define EXT4_XATTR_SIZE_MAX (1 << 24) +#define EXT4_XATTR_SIZE_MAX XATTR_SIZE_MAX =20 /* * The minimum size of EA value when you start storing it in an external i= node --=20 2.31.1 From nobody Thu Sep 18 09:55:23 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0EEF4C352A1 for ; Wed, 7 Dec 2022 07:20:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229802AbiLGHUR (ORCPT ); Wed, 7 Dec 2022 02:20:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50584 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229732AbiLGHT4 (ORCPT ); Wed, 7 Dec 2022 02:19:56 -0500 Received: from dggsgout12.his.huawei.com (unknown [45.249.212.56]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6869631FA9; Tue, 6 Dec 2022 23:19:55 -0800 (PST) Received: from mail02.huawei.com (unknown [172.30.67.153]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTP id 4NRpZY60v8z4f3mSd; Wed, 7 Dec 2022 15:19:49 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.127.227]) by APP4 (Coremail) with SMTP id gCh0CgBniteWPpBj6qE0Bw--.52253S6; Wed, 07 Dec 2022 15:19:52 +0800 (CST) From: Ye Bin To: tytso@mit.edu, adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org Cc: linux-kernel@vger.kernel.org, jack@suse.cz, Ye Bin Subject: [PATCH v2 2/6] ext4: add primary check extended attribute inode in ext4_xattr_check_entries() Date: Wed, 7 Dec 2022 15:40:39 +0800 Message-Id: <20221207074043.1286731-3-yebin@huaweicloud.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221207074043.1286731-1-yebin@huaweicloud.com> References: <20221207074043.1286731-1-yebin@huaweicloud.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: gCh0CgBniteWPpBj6qE0Bw--.52253S6 X-Coremail-Antispam: 1UD129KBjvJXoWxGF13CFykKry7Cw45ur1kGrg_yoW5ZF4rpa 13Jr98Gr4UJFyDWrySyw1UZwnIga1xGFWjvFyxKw1FyF17Xrn7tFyFqF90kF1jyrWkGw1j qa98tr1Uua13u3DanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvGb4IE77IF4wAFF20E14v26ryj6rWUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUXw A2048vs2IY020Ec7CjxVAFwI0_Gr0_Xr1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0rcxS w2x7M28EF7xvwVC0I7IYx2IY67AKxVW7JVWDJwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxV W8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I0E14v2 6rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMc Ij6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_ Jr0_Gr1lF7xvr2IYc2Ij64vIr41l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr 0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY 17CE14v26r126r1DMIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcV C0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY 6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa 73UjIFyTuYvjxU2_MaUUUUU X-CM-SenderInfo: p1hex046kxt4xhlfz01xgou0bp/ X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Bin Add primary check for extended attribute inode, only do hash check when read ea_inode's data in ext4_xattr_inode_get(). Signed-off-by: Ye Bin --- fs/ext4/xattr.c | 41 ++++++++++++++++++++++++++++++++++++----- 1 file changed, 36 insertions(+), 5 deletions(-) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 718ef3987f94..eed001eee3ec 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -83,6 +83,9 @@ static __le32 ext4_xattr_hash_entry(char *name, size_t na= me_len, __le32 *value, size_t value_count); static void ext4_xattr_rehash(struct ext4_xattr_header *); =20 +static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_in= o, + u32 ea_inode_hash, struct inode **ea_inode); + static const struct xattr_handler * const ext4_xattr_handler_map[] =3D { [EXT4_XATTR_INDEX_USER] =3D &ext4_xattr_user_handler, #ifdef CONFIG_EXT4_FS_POSIX_ACL @@ -181,9 +184,32 @@ ext4_xattr_handler(int name_index) return handler; } =20 +static inline int ext4_xattr_check_extra_inode(struct inode *inode, + struct ext4_xattr_entry *entry) +{ + int err; + struct inode *ea_inode; + + err =3D ext4_xattr_inode_iget(inode, le32_to_cpu(entry->e_value_inum), + le32_to_cpu(entry->e_hash), &ea_inode); + if (err) + return err; + + if (i_size_read(ea_inode) !=3D le32_to_cpu(entry->e_value_size)) { + ext4_warning_inode(ea_inode, + "ea_inode file size=3D%llu entry size=3D%u", + i_size_read(ea_inode), + le32_to_cpu(entry->e_value_size)); + err =3D -EFSCORRUPTED; + } + iput(ea_inode); + + return err; +} + static int -ext4_xattr_check_entries(struct ext4_xattr_entry *entry, void *end, - void *value_start) +ext4_xattr_check_entries(struct inode *inode, struct ext4_xattr_entry *ent= ry, + void *end, void *value_start) { struct ext4_xattr_entry *e =3D entry; =20 @@ -221,6 +247,10 @@ ext4_xattr_check_entries(struct ext4_xattr_entry *entr= y, void *end, size > end - value || EXT4_XATTR_SIZE(size) > end - value) return -EFSCORRUPTED; + } else if (entry->e_value_inum) { + int err =3D ext4_xattr_check_extra_inode(inode, entry); + if (err) + return err; } entry =3D EXT4_XATTR_NEXT(entry); } @@ -243,8 +273,8 @@ __ext4_xattr_check_block(struct inode *inode, struct bu= ffer_head *bh, error =3D -EFSBADCRC; if (!ext4_xattr_block_csum_verify(inode, bh)) goto errout; - error =3D ext4_xattr_check_entries(BFIRST(bh), bh->b_data + bh->b_size, - bh->b_data); + error =3D ext4_xattr_check_entries(inode, BFIRST(bh), + bh->b_data + bh->b_size, bh->b_data); errout: if (error) __ext4_error_inode(inode, function, line, 0, -error, @@ -268,7 +298,8 @@ __xattr_check_inode(struct inode *inode, struct ext4_xa= ttr_ibody_header *header, if (end - (void *)header < sizeof(*header) + sizeof(u32) || (header->h_magic !=3D cpu_to_le32(EXT4_XATTR_MAGIC))) goto errout; - error =3D ext4_xattr_check_entries(IFIRST(header), end, IFIRST(header)); + error =3D ext4_xattr_check_entries(inode, IFIRST(header), end, + IFIRST(header)); errout: if (error) __ext4_error_inode(inode, function, line, 0, -error, --=20 2.31.1 From nobody Thu Sep 18 09:55:23 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77AE3C47089 for ; Wed, 7 Dec 2022 07:20:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229748AbiLGHT7 (ORCPT ); Wed, 7 Dec 2022 02:19:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50574 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229640AbiLGHT4 (ORCPT ); Wed, 7 Dec 2022 02:19:56 -0500 Received: from dggsgout11.his.huawei.com (unknown [45.249.212.51]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 49EC631EEE; Tue, 6 Dec 2022 23:19:55 -0800 (PST) Received: from mail02.huawei.com (unknown [172.30.67.153]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTP id 4NRpZY49dDz4f3vf8; Wed, 7 Dec 2022 15:19:49 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.127.227]) by APP4 (Coremail) with SMTP id gCh0CgBniteWPpBj6qE0Bw--.52253S7; Wed, 07 Dec 2022 15:19:52 +0800 (CST) From: Ye Bin To: tytso@mit.edu, adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org Cc: linux-kernel@vger.kernel.org, jack@suse.cz, Ye Bin Subject: [PATCH v2 3/6] ext4: remove unnessary size check in ext4_xattr_inode_get() Date: Wed, 7 Dec 2022 15:40:40 +0800 Message-Id: <20221207074043.1286731-4-yebin@huaweicloud.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221207074043.1286731-1-yebin@huaweicloud.com> References: <20221207074043.1286731-1-yebin@huaweicloud.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: gCh0CgBniteWPpBj6qE0Bw--.52253S7 X-Coremail-Antispam: 1UD129KBjvdXoW7Jw4rXF1fZw15GrWfur4xXrb_yoW3trXEya 4qqr4UGr43Xr1xWrWDAF1ay3ZYy3W8Gr1fuF4kJFy7Z3WaqayvvrWDXrWUZr13Ww4rt3Z8 Z34DJrW7GFyFgjkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUIcSsGvfJTRUUUbV8YFVCjjxCrM7AC8VAFwI0_Wr0E3s1l1xkIjI8I6I8E6xAIw20E Y4v20xvaj40_Wr0E3s1l1IIY67AEw4v_Jr0_Jr4l82xGYIkIc2x26280x7IE14v26r1rM2 8IrcIa0xkI8VCY1x0267AKxVW8JVW5JwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK 021l84ACjcxK6xIIjxv20xvE14v26F1j6w1UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r 4UJVWxJr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_ GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx 0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWU JVW8JwACjcxG0xvY0x0EwIxGrwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJV W8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF 1VAFwI0_JF0_Jw1lIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6x IIjxv20xvEc7CjxVAFwI0_Gr0_Cr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvE x4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvj DU0xZFpf9x07jnyCJUUUUU= X-CM-SenderInfo: p1hex046kxt4xhlfz01xgou0bp/ X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Bin As previous patch add check in ext4_xattr_check_entries(), before call ext4_xattr_inode_get() will already do xattr entries check. Signed-off-by: Ye Bin --- fs/ext4/xattr.c | 8 -------- 1 file changed, 8 deletions(-) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index eed001eee3ec..75287422c36c 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -525,14 +525,6 @@ ext4_xattr_inode_get(struct inode *inode, struct ext4_= xattr_entry *entry, goto out; } =20 - if (i_size_read(ea_inode) !=3D size) { - ext4_warning_inode(ea_inode, - "ea_inode file size=3D%llu entry size=3D%zu", - i_size_read(ea_inode), size); - err =3D -EFSCORRUPTED; - goto out; - } - err =3D ext4_xattr_inode_read(ea_inode, buffer, size); if (err) goto out; --=20 2.31.1 From nobody Thu Sep 18 09:55:23 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BCC6C47089 for ; Wed, 7 Dec 2022 07:20:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229796AbiLGHUN (ORCPT ); Wed, 7 Dec 2022 02:20:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50580 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229728AbiLGHT4 (ORCPT ); Wed, 7 Dec 2022 02:19:56 -0500 Received: from dggsgout11.his.huawei.com (unknown [45.249.212.51]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 90E333204A; Tue, 6 Dec 2022 23:19:55 -0800 (PST) Received: from mail02.huawei.com (unknown [172.30.67.153]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTP id 4NRpZY6TMvz4f3k6c; Wed, 7 Dec 2022 15:19:49 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.127.227]) by APP4 (Coremail) with SMTP id gCh0CgBniteWPpBj6qE0Bw--.52253S8; Wed, 07 Dec 2022 15:19:52 +0800 (CST) From: Ye Bin To: tytso@mit.edu, adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org Cc: linux-kernel@vger.kernel.org, jack@suse.cz, Ye Bin Subject: [PATCH v2 4/6] ext4: allocate extended attribute value in vmalloc area Date: Wed, 7 Dec 2022 15:40:41 +0800 Message-Id: <20221207074043.1286731-5-yebin@huaweicloud.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221207074043.1286731-1-yebin@huaweicloud.com> References: <20221207074043.1286731-1-yebin@huaweicloud.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: gCh0CgBniteWPpBj6qE0Bw--.52253S8 X-Coremail-Antispam: 1UD129KBjvJXoW7ArW3JF1DJr18Kw4kZry3XFb_yoW8JFy3pa 95K340kr43Wry7urWxCF4xZ3sFg3ZrKr4UGay3Xw40vFy5Xwn2gFy5tFWYvF1UZFWxtw4v qF1Dtr18Za13t3DanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvEb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUAV Cq3wA2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0 rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVW7JVWDJwA2z4x0Y4vE2Ix0cI8IcVCY1x0267 AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I0E 14v26rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7 xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Y z7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7 v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF 1VAY17CE14v26r126r1DMIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIx AIcVC0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI 42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWI evJa73UjIFyTuYvjxUFgAwUUUUU X-CM-SenderInfo: p1hex046kxt4xhlfz01xgou0bp/ X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Bin Now, extended attribute value maxium length is 64K. The memory requested he= re does not need continuous physical addresses, so it is appropriate to use kvmalloc to request memory. At the same time, it can also cope with the situation that the extended attribute will become longer in the future. Signed-off-by: Ye Bin Reviewed-by: Jan Kara --- fs/ext4/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 75287422c36c..efa623658c12 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -2579,7 +2579,7 @@ static int ext4_xattr_move_to_block(handle_t *handle,= struct inode *inode, =20 is =3D kzalloc(sizeof(struct ext4_xattr_ibody_find), GFP_NOFS); bs =3D kzalloc(sizeof(struct ext4_xattr_block_find), GFP_NOFS); - buffer =3D kmalloc(value_size, GFP_NOFS); + buffer =3D kvmalloc(value_size, GFP_NOFS); b_entry_name =3D kmalloc(entry->e_name_len + 1, GFP_NOFS); if (!is || !bs || !buffer || !b_entry_name) { error =3D -ENOMEM; @@ -2631,7 +2631,7 @@ static int ext4_xattr_move_to_block(handle_t *handle,= struct inode *inode, error =3D 0; out: kfree(b_entry_name); - kfree(buffer); + kvfree(buffer); if (is) brelse(is->iloc.bh); if (bs) --=20 2.31.1 From nobody Thu Sep 18 09:55:23 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 688DBC352A1 for ; Wed, 7 Dec 2022 07:20:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229816AbiLGHUW (ORCPT ); Wed, 7 Dec 2022 02:20:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50586 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229738AbiLGHT5 (ORCPT ); Wed, 7 Dec 2022 02:19:57 -0500 Received: from dggsgout12.his.huawei.com (unknown [45.249.212.56]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF40F32057; Tue, 6 Dec 2022 23:19:55 -0800 (PST) Received: from mail02.huawei.com (unknown [172.30.67.153]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTP id 4NRpZZ5LM9z4f3sC7; Wed, 7 Dec 2022 15:19:50 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.127.227]) by APP4 (Coremail) with SMTP id gCh0CgBniteWPpBj6qE0Bw--.52253S9; Wed, 07 Dec 2022 15:19:53 +0800 (CST) From: Ye Bin To: tytso@mit.edu, adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org Cc: linux-kernel@vger.kernel.org, jack@suse.cz, Ye Bin Subject: [PATCH v2 5/6] ext4: rename xattr_find_entry() and __xattr_check_inode() Date: Wed, 7 Dec 2022 15:40:42 +0800 Message-Id: <20221207074043.1286731-6-yebin@huaweicloud.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221207074043.1286731-1-yebin@huaweicloud.com> References: <20221207074043.1286731-1-yebin@huaweicloud.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: gCh0CgBniteWPpBj6qE0Bw--.52253S9 X-Coremail-Antispam: 1UD129KBjvJXoW3GrW3AFW3JFyUXw13JF4kCrg_yoW7GFWkpF yUJa4DJr48JryUur40yr17Zw1ag3W7Gay7ZayxC3WSyF1DXwn7tFyFkFn5CFyUur4kWw42 qF43K348u3WSk3DanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvEb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUAV Cq3wA2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0 rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVW7JVWDJwA2z4x0Y4vE2Ix0cI8IcVCY1x0267 AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I0E 14v26rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7 xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Y z7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7 v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF 1VAY17CE14v26r126r1DMIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_JFI_Gr1lIx AIcVC0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI 42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWI evJa73UjIFyTuYvjxUFgAwUUUUU X-CM-SenderInfo: p1hex046kxt4xhlfz01xgou0bp/ X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Bin xattr_find_entry() and __xattr_check_inode() is in EXT4 xattr module. so add 'ext4' prefix to unify name style. Signed-off-by: Ye Bin Reviewed-by: Jan Kara --- fs/ext4/xattr.c | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index efa623658c12..5c0476ff62c8 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -290,8 +290,9 @@ __ext4_xattr_check_block(struct inode *inode, struct bu= ffer_head *bh, =20 =20 static int -__xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *h= eader, - void *end, const char *function, unsigned int line) +__ext4_xattr_check_inode(struct inode *inode, + struct ext4_xattr_ibody_header *header, void *end, + const char *function, unsigned int line) { int error =3D -EFSCORRUPTED; =20 @@ -307,12 +308,12 @@ __xattr_check_inode(struct inode *inode, struct ext4_= xattr_ibody_header *header, return error; } =20 -#define xattr_check_inode(inode, header, end) \ - __xattr_check_inode((inode), (header), (end), __func__, __LINE__) +#define ext4_xattr_check_inode(inode, header, end) \ + __ext4_xattr_check_inode((inode), (header), (end), __func__, __LINE__) =20 static int -xattr_find_entry(struct inode *inode, struct ext4_xattr_entry **pentry, - void *end, int name_index, const char *name, int sorted) +ext4_xattr_find_entry(struct inode *inode, struct ext4_xattr_entry **pentr= y, + void *end, int name_index, const char *name, int sorted) { struct ext4_xattr_entry *entry, *next; size_t name_len; @@ -577,7 +578,7 @@ ext4_xattr_block_get(struct inode *inode, int name_inde= x, const char *name, ext4_xattr_block_cache_insert(ea_block_cache, bh); entry =3D BFIRST(bh); end =3D bh->b_data + bh->b_size; - error =3D xattr_find_entry(inode, &entry, end, name_index, name, 1); + error =3D ext4_xattr_find_entry(inode, &entry, end, name_index, name, 1); if (error) goto cleanup; size =3D le32_to_cpu(entry->e_value_size); @@ -628,11 +629,11 @@ ext4_xattr_ibody_get(struct inode *inode, int name_in= dex, const char *name, raw_inode =3D ext4_raw_inode(&iloc); header =3D IHDR(inode, raw_inode); end =3D (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; - error =3D xattr_check_inode(inode, header, end); + error =3D ext4_xattr_check_inode(inode, header, end); if (error) goto cleanup; entry =3D IFIRST(header); - error =3D xattr_find_entry(inode, &entry, end, name_index, name, 0); + error =3D ext4_xattr_find_entry(inode, &entry, end, name_index, name, 0); if (error) goto cleanup; size =3D le32_to_cpu(entry->e_value_size); @@ -773,7 +774,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buff= er, size_t buffer_size) raw_inode =3D ext4_raw_inode(&iloc); header =3D IHDR(inode, raw_inode); end =3D (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; - error =3D xattr_check_inode(inode, header, end); + error =3D ext4_xattr_check_inode(inode, header, end); if (error) goto cleanup; error =3D ext4_xattr_list_entries(dentry, IFIRST(header), @@ -859,7 +860,7 @@ int ext4_get_inode_usage(struct inode *inode, qsize_t *= usage) raw_inode =3D ext4_raw_inode(&iloc); header =3D IHDR(inode, raw_inode); end =3D (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; - ret =3D xattr_check_inode(inode, header, end); + ret =3D ext4_xattr_check_inode(inode, header, end); if (ret) goto out; =20 @@ -1862,8 +1863,8 @@ ext4_xattr_block_find(struct inode *inode, struct ext= 4_xattr_info *i, bs->s.first =3D BFIRST(bs->bh); bs->s.end =3D bs->bh->b_data + bs->bh->b_size; bs->s.here =3D bs->s.first; - error =3D xattr_find_entry(inode, &bs->s.here, bs->s.end, - i->name_index, i->name, 1); + error =3D ext4_xattr_find_entry(inode, &bs->s.here, bs->s.end, + i->name_index, i->name, 1); if (error && error !=3D -ENODATA) return error; bs->s.not_found =3D error; @@ -2222,12 +2223,12 @@ int ext4_xattr_ibody_find(struct inode *inode, stru= ct ext4_xattr_info *i, is->s.here =3D is->s.first; is->s.end =3D (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) { - error =3D xattr_check_inode(inode, header, is->s.end); + error =3D ext4_xattr_check_inode(inode, header, is->s.end); if (error) return error; /* Find the named attribute. */ - error =3D xattr_find_entry(inode, &is->s.here, is->s.end, - i->name_index, i->name, 0); + error =3D ext4_xattr_find_entry(inode, &is->s.here, is->s.end, + i->name_index, i->name, 0); if (error && error !=3D -ENODATA) return error; is->s.not_found =3D error; @@ -2742,7 +2743,7 @@ int ext4_expand_extra_isize_ea(struct inode *inode, i= nt new_extra_isize, min_offs =3D end - base; total_ino =3D sizeof(struct ext4_xattr_ibody_header) + sizeof(u32); =20 - error =3D xattr_check_inode(inode, header, end); + error =3D ext4_xattr_check_inode(inode, header, end); if (error) goto cleanup; =20 --=20 2.31.1 From nobody Thu Sep 18 09:55:23 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B65A1C352A1 for ; Wed, 7 Dec 2022 07:20:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229786AbiLGHUJ (ORCPT ); Wed, 7 Dec 2022 02:20:09 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50582 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229562AbiLGHT4 (ORCPT ); Wed, 7 Dec 2022 02:19:56 -0500 Received: from dggsgout11.his.huawei.com (unknown [45.249.212.51]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 00E1432058; Tue, 6 Dec 2022 23:19:55 -0800 (PST) Received: from mail02.huawei.com (unknown [172.30.67.153]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTP id 4NRpZZ3MZRz4f3vfW; Wed, 7 Dec 2022 15:19:50 +0800 (CST) Received: from huaweicloud.com (unknown [10.175.127.227]) by APP4 (Coremail) with SMTP id gCh0CgBniteWPpBj6qE0Bw--.52253S10; Wed, 07 Dec 2022 15:19:53 +0800 (CST) From: Ye Bin To: tytso@mit.edu, adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org Cc: linux-kernel@vger.kernel.org, jack@suse.cz, Ye Bin Subject: [PATCH v2 6/6] ext4: fix inode leak in 'ext4_xattr_inode_create()' Date: Wed, 7 Dec 2022 15:40:43 +0800 Message-Id: <20221207074043.1286731-7-yebin@huaweicloud.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20221207074043.1286731-1-yebin@huaweicloud.com> References: <20221207074043.1286731-1-yebin@huaweicloud.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: gCh0CgBniteWPpBj6qE0Bw--.52253S10 X-Coremail-Antispam: 1UD129KBjvJXoW7Aw4ftr4kJr4DAF13Xw17trb_yoW8Gry7pr sxJr18Kr48uFyqg3yFyFs7Z3srKasrGr4UJFWUKw1rAF98Wasaqa45Kr4rAF1UJr4ktw1F qF1UCrWFvr45AaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvEb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUAV Cq3wA2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0 rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVWDJVCq3wA2z4x0Y4vE2Ix0cI8IcVCY1x0267 AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I0E 14v26rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7 xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Y z7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7 v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF 1VAY17CE14v26r126r1DMIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_JFI_Gr1lIx AIcVC0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI 42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWI evJa73UjIFyTuYvjxUFgAwUUUUU X-CM-SenderInfo: p1hex046kxt4xhlfz01xgou0bp/ X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Bin There is issue as follows when do setxattr with inject fault: [localhost]#fsck.ext4 -fn /dev/sda e2fsck 1.46.6-rc1 (12-Sep-2022) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Unattached zero-length inode 15. Clear? no Unattached inode 15 Connect to /lost+found? no Pass 5: Checking group summary information /dev/sda: ********** WARNING: Filesystem still has errors ********** /dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks Above issue occur in 'ext4_xattr_inode_create()', if 'ext4_mark_inode_dirty= ()' failed need to drop inode's i_nlink. Or will lead to inode leak. Signed-off-by: Ye Bin Reviewed-by: Jan Kara --- fs/ext4/xattr.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 5c0476ff62c8..6c19d01ba261 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1465,6 +1465,9 @@ static struct inode *ext4_xattr_inode_create(handle_t= *handle, if (!err) err =3D ext4_inode_attach_jinode(ea_inode); if (err) { + if (ext4_xattr_inode_dec_ref(handle, ea_inode)) + ext4_warning_inode(ea_inode, + "cleanup dec ref error %d", err); iput(ea_inode); return ERR_PTR(err); } --=20 2.31.1