From nobody Tue Dec 2 01:50:45 2025 Received: from mail-ej1-f47.google.com (mail-ej1-f47.google.com [209.85.218.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 19B24241679 for ; Fri, 21 Nov 2025 00:22:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763684565; cv=none; b=RuJGChMD/RLi8dEuAfQF2Ei0aIVZM3iNY99n8l18iD7TWswhsH4MAUzFNtrldWw8ZOP9dh2qemPyjfV/XHp4T1fMJaNW3PhL0NDgsuWIetxqG+jO834lAXN05/oFe7kEITCj78DW/F6VARwO4pLAzM0riOAlCOL98+eLmp0/NZQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763684565; c=relaxed/simple; bh=rom/AwKjWUnt+Gj6Y8kFDA1w9rDZCmrd55mGQuNpbgY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Oxs22MnaAbb5aeDNO3/PUkFB0q7bbz6/edbj+/l5hXsT12E+i1kPAle86jrXB6K0kDCH8Zi1T/91d8ifZAqMwhqL5zqHKeUrTtyxqDavtEIll6/kMnANIccR9/6Aq48rh0ijvu6EVI/3TN+y2mc/R8cjkz4fdTS+5QoM2g7NDkw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=eLsHGPYA; arc=none smtp.client-ip=209.85.218.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eLsHGPYA" Received: by mail-ej1-f47.google.com with SMTP id a640c23a62f3a-b735ce67d1dso234226266b.3 for ; Thu, 20 Nov 2025 16:22:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763684562; x=1764289362; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=L5eibNO90Ald5K87n6GVEVhxh4o5x1NRdi3fUbNI3Ks=; b=eLsHGPYAo8l43wx6e/Z0D9my5/pwyJxn9lWhF+myyO7m8KfGAElJxf+ZicvdRZWeb7 pt3gRdHq9Xz8bEBts5oXaF6DtfmdW8QUhNNqqmrkkIVjAZXnQqdR0mugO16CYWalaYm4 M6qvkc3CnZvidxSv/ujRhPhb3gRypwgEy+C+KdjWd7K5xqQAf+laCcOfiRPeFwARXP5G 6RU+bIcFSzXipsgyGY3aT6gn1DqC9EuB3qYa5OEM8Uw7+OQfw28EayDcPa1SM8aEi7Or k+LrpERMi0VOXh10/pqPO31umpQp1SzD2npmx6zU14lVWaoMSXUyQXTUV1myEU4BTIVe adKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763684562; x=1764289362; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=L5eibNO90Ald5K87n6GVEVhxh4o5x1NRdi3fUbNI3Ks=; b=suIG9CsF/21U9KtDLsoXQ7CPsLZlZbeLFnQBtMFT/FkNG+SssIid159JnWKDrZJiZ0 mkdpoZFVA0gmkxyNl8YJArMYJRu02TSszFg1ZenciTNJyRk1/w6CCtCRlbwhJCzWsQVx CuMdHAaPdyXoTqOGxLcM4AEJ+XfErfBX6guicYjYkRgbvLi1lhHEnJ8bKKCWHzwP++ad anyEh2ThrbxlPdzwfLu+0wB2j477smq4SegaQVvxbVEC042brS76X4ll/IDHnClFy4hb e55dGG2PocErfJJPmBnvDYKYU198tFh6ED0Q56gpT1v8eK1+3lYPs40Kx6G/UHtQLMsv 3uxA== X-Forwarded-Encrypted: i=1; AJvYcCVKEsPYRGAtM6HhI+zwYjhAwpba4btaQ3eNnhpCj6tS/iW25OVb8UZ2dVdUvMSb6FXBNJRiYKZYXZHe/Eg=@vger.kernel.org X-Gm-Message-State: AOJu0YxT4fcAUxT67DEhGxG5wqCshVRS/eZag+Zm8MEis28GhRUoVs5w LiMez7YJ7gFIbOKBNGnVYLYAAFddo8DMViNWgfxFwIwBOpR53QcRK/an X-Gm-Gg: ASbGncuK6zx7Wxiw5NOzzdu9QxAkCQl7iByl/nfqZ6nasL+1yaHKbSDcFLWhrrmdCO0 CeVMFDgVAh73VyX8aalDf9J5snHrCDeVAJEPuC1BArpFY3Ido2Rgs6dLMcehrw5xEt9vCuxOznl x2vawaqwabyK0cdDnBM79u8MZ9uwiKEDgOriahex9Kxcj/hXQ3fNiZ0++CS9fb9AnUBZOawraIY iUNzxCzDdMooNNJPqTkaOEW8+QeW7M2jCaxCDjXEvjsPU/WVyGfaHSQRSksbjDufG4LA9NbmZdZ yPgxpC4+7q8B//0J8p9vITX+nfZsqkPAv+V3Q5S8GN5xvQPHh96JWxcLGoxxh27fguEDVPGCu6y qXoIcHdtWjxiubO+k66rpJd3uHOibf9pwA5U6tjJfkr78HFF3SLFGbCir87kaGIVvj1CyQ/koh6 dlo3dqC0R4GIE= X-Google-Smtp-Source: AGHT+IFUFHpAifxZcReeziSuOwRDZUEv66W2Z4nfjWxiQbaXSc3qoEN/J/SAU6TFywHoHAyBWMWpHg== X-Received: by 2002:a17:906:4fc7:b0:b73:42df:27a with SMTP id a640c23a62f3a-b767151b071mr22897166b.1.1763684562161; Thu, 20 Nov 2025 16:22:42 -0800 (PST) Received: from eray-kasa.. ([2a02:4e0:2d18:6ce:7ff1:1161:673b:41e5]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b7654d502cfsm322788966b.19.2025.11.20.16.22.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Nov 2025 16:22:41 -0800 (PST) From: Ahmet Eray Karadag To: tytso@mit.edu, adilger.kernel@dilger.ca Cc: linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, david.hunter.linux@gmail.com, skhan@linuxfoundation.org, Ahmet Eray Karadag , syzbot+ee60e584b5c6bb229126@syzkaller.appspotmail.com, Albin Babu Varghese Subject: [PATCH] ext4: fix unaligned preallocation with bigalloc Date: Fri, 21 Nov 2025 03:22:10 +0300 Message-ID: <20251121002209.416949-2-eraykrdg1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Syzkaller reported a use-after-free in ext4_find_extent() when using bigalloc. The crash occurs during the extent tree traversal when the system tries to access a freed extent path. The root cause is related to how the multi-block allocator (mballoc) handles alignment in bigalloc filesystems (s_cluster_ratio > 1). When a request for a block is made, mballoc might return a goal start block that is not aligned to the cluster boundary (e.g., block 1 instead of 0) because the cluster start is busy. Previously, ext4_mb_new_inode_pa() and ext4_mb_new_group_pa() did not strictly enforce cluster alignment or handle collisions where aligning down would overlap with busy space. This resulted in the creation of Preallocation (PA) extents that started in the middle of a cluster. This misalignment causes metadata inconsistency between the physical allocation (bitmap) and the logical extent tree, eventually leading to a use-after-free during inode eviction or truncation. This patch fixes the issue by enforcing strict cluster alignment for both inode and group preallocations. Using AC_STATUS_BREAK ensures that we do not manually free the PA (avoiding double-free bugs in the caller's cleanup path) and allows the allocator to find a more suitable block group. Tested with kvm-xfstests -c bigalloc_4k -g quick, no regressions found. Reported-by: syzbot+ee60e584b5c6bb229126@syzkaller.appspotmail.com Fixes: https://syzkaller.appspot.com/bug?extid=3Dee60e584b5c6bb229126 Co-developed-by: Albin Babu Varghese Signed-off-by: Albin Babu Varghese Signed-off-by: Ahmet Eray Karadag --- fs/ext4/mballoc.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 9087183602e4..549d6cf58f3c 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -5291,6 +5291,21 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context = *ac) =20 ex.fe_logical =3D ac->ac_o_ex.fe_logical; adjust_bex: + if (sbi->s_cluster_ratio > 1) { + loff_t mask =3D ~(sbi->s_cluster_ratio - 1); + loff_t aligned_start =3D ex.fe_logical & mask; + + if (aligned_start < ac->ac_g_ex.fe_logical) { + ac->ac_status =3D AC_STATUS_BREAK; + return; + } + + ex.fe_len +=3D (ex.fe_logical - aligned_start); + ex.fe_logical =3D aligned_start; + + if (ex.fe_logical + ex.fe_len > orig_goal_end) + ex.fe_len =3D orig_goal_end - ex.fe_logical; + } ac->ac_b_ex.fe_logical =3D ex.fe_logical; =20 BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical); @@ -5336,6 +5351,7 @@ static noinline_for_stack void ext4_mb_new_group_pa(struct ext4_allocation_context *ac) { struct super_block *sb =3D ac->ac_sb; + struct ext4_sb_info *sbi =3D EXT4_SB(sb); struct ext4_locality_group *lg; struct ext4_prealloc_space *pa; struct ext4_group_info *grp; @@ -5347,7 +5363,15 @@ ext4_mb_new_group_pa(struct ext4_allocation_context = *ac) BUG_ON(ac->ac_pa =3D=3D NULL); =20 pa =3D ac->ac_pa; + if (sbi->s_cluster_ratio > 1) { + loff_t mask =3D ~(sbi->s_cluster_ratio - 1); + loff_t pstart =3D ext4_grp_offs_to_block(sb, &ac->ac_b_ex); =20 + if ((pstart & mask) < pstart) { + ac->ac_status =3D AC_STATUS_BREAK; + return; + } + } pa->pa_pstart =3D ext4_grp_offs_to_block(sb, &ac->ac_b_ex); pa->pa_lstart =3D pa->pa_pstart; pa->pa_len =3D ac->ac_b_ex.fe_len; --=20 2.43.0