From nobody Tue Dec 2 01:04:44 2025 Received: from mail-ed1-f51.google.com (mail-ed1-f51.google.com [209.85.208.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C964E1FE45D for ; Sat, 22 Nov 2025 02:49:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763779783; cv=none; b=kSUVoONQ4okVeaA1psxLhMMJi34Nf1KzbkxKrvgrvSgOXlhMXgGgbfRrjf3bdzZJl/PxM/dfs/ncbIFK1dczcXC/gzUr9ufSxPXTVAG0JgnyPOrSfNZzqjThbZmRSs9A7rmmw43o0mrifZPt52CWXKVYjtoHP8+tV3pQELvCGaA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763779783; c=relaxed/simple; bh=sa6mcig//Mcew/EeLoyFl/4GJB8qLX2slgNI2llnzD4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dLDwaqRFwSMSuTZFfWpl0P9UvBw3s+r7q9eN/ZYRysM1lmvwwh3A4YS6Zhj/u4cp9LGt9EPXRA9GseQCR1FZsGZLL1+/003D605/lRXDW/61UI2Hd8HqnF4oSlJu+K2OUyyEB0Q9r3miYrQWg9GnfBwzSKAeLP8XmzQwAqIPbOU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XAFfPZmT; arc=none smtp.client-ip=209.85.208.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XAFfPZmT" Received: by mail-ed1-f51.google.com with SMTP id 4fb4d7f45d1cf-63c489f1e6cso3370913a12.1 for ; Fri, 21 Nov 2025 18:49:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763779780; x=1764384580; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=KnHYS7bdbqInDphgttN+cPizyxQKoLAz9iQUAbHEgu8=; b=XAFfPZmTTDFeG0moayZIWI+/YP+fDNXptDQBN72YopmCWaKT6I8VKs6qHwNyOHDXa8 Jbe6oe/7eCPSJHJgsstQc8MNId25jjUXjrz3Hiy+VtRIZ5rORTxpNHa1y0/UyUekHywT MCK1ipO4E+YnX2zb2W+4hgK1mtse0QihyBgpL2z98QCvSj5JpNYkQmfL+H31lRzL9LvV x4d9u/cJvj+hJTFJKgubXO/zG1w3SnfrznCVuklURH5DA50YwSN0sUe6wBVOW3hBQGjU 6FgJre0bZDE2bquaoW1lUvZt1BKoabqAlcf9AdLjD0XKq3KLJ1y9Xp07fGpfI6ZnTCG2 r1Sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763779780; x=1764384580; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=KnHYS7bdbqInDphgttN+cPizyxQKoLAz9iQUAbHEgu8=; b=Go51nfDR/Uo0eWKQ/lVt/hVdN+JtXEVVv/mI/Sf/4YR/0AGt7y3Gb1NxWvBofYA0OI lvJvN8iXTChHhcxJG3o0cfvRzantEWbH3Qn+syMC6O68dUHaCbGsttzfDCEc2UJkACzQ Vw6TXUb1D61DaG484eb2Dx8XdAxY6uKZMGp1MYYkw38Py/mjwG7W+ZWDIis+obS4DpoI quj8guhJXDiLvfu+9nQAWfQZGaiVQ0lMW9mbu5QXSxLVYwaPYFAZwsUSFmLNWZFDU8Mv lO+7p0unC3VHfgEcHBtcnnA7Lk7hYnBfS8dOxorwFcY9TBIAo+CdZvBZK8jCZFlCRcsx 1xcQ== X-Forwarded-Encrypted: i=1; AJvYcCWuSvyZhXy6SmNqN89xYmEhKE+GZq/fyQdKDLycW5homNguR256c7QTqKS6HX3eWTKIJsDE53qdQFMYz5c=@vger.kernel.org X-Gm-Message-State: AOJu0YyeR5hqfa99TDzyr0MlPl7QKMon5pnXqUQaUaugB7jIxUAWgki5 h78RrUHy2fuyzFqZDpCP+Q0jmKFKObbEAtxa6OomttOWdjLEAfSeLtuN X-Gm-Gg: ASbGncvNqIjh397t3K0JuXDY/uzhX2wT/1flRYxcgZfWKwjSgfVsfAW0dxst/Ud1VvH dyKqipVrqCF91+KNH8rLNWcGzYEGCDy6v58IobUCPcXa9Q0Sil1+RJ1+s0+DYrCoYNAHcEpQI2W gPmFjVzzg1IvsXeCqmxAzq2hhY8EC37J3rQ6QVQUCmCJGI+x7/gFQearzpUkGYFbvGybK3ImLp0 osgIUz1laruW6O9ucljnBCz81M5KQinqi29QMuoOEl3fuDpMaIVODh/9tJC512PVGu2vK7+n+O6 M/FNluwUsjvzvp2db4GXRM25ZBV2ppjNh5A8b+0Z+p7dqrcwvkYOTiUUi8qGuhVjTO1j0Nvqnfu nimbNpBQ/yDiyR+YSGWvliMN2FRF9RDisiOHs/w2mAWlDfvB9d+L/VXOoty2bXWrbXAtChaBhHD mVAyJ8A+JcEwDq X-Google-Smtp-Source: AGHT+IFsP8W53rvT11Kbkp3Q1NBm6rQma1a4c0VWOCZYCdxPAkvafeClv3FEkEEKh622Y3fsOcqKZw== X-Received: by 2002:a05:6402:42c7:b0:640:b07c:5704 with SMTP id 4fb4d7f45d1cf-645550f2186mr4469181a12.15.1763779779940; Fri, 21 Nov 2025 18:49:39 -0800 (PST) Received: from eray-kasa.. ([2a02:4e0:2d15:1b7a:7e69:bd3d:4508:8aee]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-645363aca03sm6307532a12.3.2025.11.21.18.49.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Nov 2025 18:49:39 -0800 (PST) From: Ahmet Eray Karadag To: tytso@mit.edu, adilger.kernel@dilger.ca Cc: linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, david.hunter.linux@gmail.com, skhan@linuxfoundation.org, Ahmet Eray Karadag , syzbot+ee60e584b5c6bb229126@syzkaller.appspotmail.com, Albin Babu Varghese Subject: [PATCH v2] ext4: fix unaligned preallocation with bigalloc Date: Sat, 22 Nov 2025 05:45:56 +0300 Message-ID: <20251122024555.140798-2-eraykrdg1@gmail.com> In-Reply-To: <20251121002209.416949-2-eraykrdg1@gmail.com> References: <20251121002209.416949-2-eraykrdg1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Syzkaller reported a use-after-free in ext4_find_extent() when using bigalloc. The crash occurs during the extent tree traversal when the system tries to access a freed extent path. The root cause is related to how the multi-block allocator (mballoc) handles alignment in bigalloc filesystems (s_cluster_ratio > 1). When a request for a block is made, mballoc might return a goal start block that is not aligned to the cluster boundary (e.g., block 1 instead of 0) because the cluster start is busy. Previously, ext4_mb_new_inode_pa() and ext4_mb_new_group_pa() did not strictly enforce cluster alignment or handle collisions where aligning down would overlap with busy space. This resulted in the creation of Preallocation (PA) extents that started in the middle of a cluster. This misalignment causes metadata inconsistency between the physical allocation (bitmap) and the logical extent tree, eventually leading to a use-after-free during inode eviction or truncation. This patch fixes the issue by enforcing strict cluster alignment for both inode and group preallocations. Using AC_STATUS_BREAK ensures that we do not manually free the PA (avoiding double-free bugs in the caller's cleanup path) and allows the allocator to find a more suitable block group. Tested with kvm-xfstests -c bigalloc_4k -g auto, no regressions found. Reported-by: syzbot+ee60e584b5c6bb229126@syzkaller.appspotmail.com Fixes: https://syzkaller.appspot.com/bug?extid=3Dee60e584b5c6bb229126 Co-developed-by: Albin Babu Varghese Signed-off-by: Albin Babu Varghese Signed-off-by: Ahmet Eray Karadag --- v2: - Removed incorrect logic that was adding block offset to cluster length (fe_len), which caused unit mismatch between clusters and blocks. --- fs/ext4/mballoc.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 9087183602e4..fefa3cc6adf8 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -5291,6 +5291,22 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context = *ac) =20 ex.fe_logical =3D ac->ac_o_ex.fe_logical; adjust_bex: + if (sbi->s_cluster_ratio > 1) { + loff_t mask =3D ~(sbi->s_cluster_ratio - 1); + loff_t aligned_start =3D ex.fe_logical & mask; + + if (aligned_start < ac->ac_g_ex.fe_logical) { + ac->ac_status =3D AC_STATUS_BREAK; + return; + } + + ex.fe_logical =3D aligned_start; + + if (extent_logical_end(sbi, &ex) > orig_goal_end) { + ac->ac_status =3D AC_STATUS_BREAK; + return; + } + } ac->ac_b_ex.fe_logical =3D ex.fe_logical; =20 BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical); @@ -5336,6 +5352,7 @@ static noinline_for_stack void ext4_mb_new_group_pa(struct ext4_allocation_context *ac) { struct super_block *sb =3D ac->ac_sb; + struct ext4_sb_info *sbi =3D EXT4_SB(sb); struct ext4_locality_group *lg; struct ext4_prealloc_space *pa; struct ext4_group_info *grp; @@ -5347,7 +5364,15 @@ ext4_mb_new_group_pa(struct ext4_allocation_context = *ac) BUG_ON(ac->ac_pa =3D=3D NULL); =20 pa =3D ac->ac_pa; + if (sbi->s_cluster_ratio > 1) { + loff_t mask =3D ~(sbi->s_cluster_ratio - 1); + loff_t pstart =3D ext4_grp_offs_to_block(sb, &ac->ac_b_ex); =20 + if ((pstart & mask) < pstart) { + ac->ac_status =3D AC_STATUS_BREAK; + return; + } + } pa->pa_pstart =3D ext4_grp_offs_to_block(sb, &ac->ac_b_ex); pa->pa_lstart =3D pa->pa_pstart; pa->pa_len =3D ac->ac_b_ex.fe_len; --=20 2.43.0