From nobody Fri Oct 2 09:26:36 2026 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 810D8335091 for ; Mon, 3 Aug 2026 03:11:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785726691; cv=none; b=qVFCuPTraPUa0evLRitPLQxtcoUsx98YZ+Y6x7nh3Mhlv8dAT0K8pRdGR50QEACGwDqorO8/saZ3niO5RTmhPnFtk6PavA4YKGYGizvnJgGQ8wtTzmHjkSfGfe9rGe4H606oo5AWoEmnbZJtoTIOBs/hI7woR0sgbQq7dWR2Xxg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785726691; c=relaxed/simple; bh=0jxhpiy+to/ITrgWlDtmvBfGJrV5Jq/iRYsgjH9IhIE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RTMSgjLx2XdjhUKXuLdxpfNB81ecIJ16sTl9LkpBwMsNIkESvQQVVnFtFDa9cTmxjbteN+qW9HUIJl3XIuqzudE1DMW0uwX9jJUvZg5W4SjOhzP8baVoDvpra8IGLhzKnxv8fvZc0h7QcF6njvwHRu5IbVSlhIrxC/q5VSpzZoY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TSUb6Z7b; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TSUb6Z7b" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-8484f229529so2239953b3a.2 for ; Sun, 02 Aug 2026 20:11:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785726690; x=1786331490; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=r/saykZZ/5vcW+2cy8muslZqFNi+RNrcC1xh2TUTBUI=; b=TSUb6Z7bkRolYYAYorUW9/uX6YcTrQAPij1psO6KTPq6rkDvj3O7Ll1VNitIWsLhvo 7+/0z9gq5JimH0PR2X7Wbh0ZCCPNIjMY1/wwius/Yr7YiYXNmvr48fHpZoIjkP3r4v/p jwj6eHN1SbGEmJyZuORBvtYeeRbv0/AAV9MI9ljGQ9btDvpJOco4oiDVUEJFf8vuWA87 KE9X//qPcSX2EqOTyOirgnC4E0FJCvCa3NPkzWtE06myhyGHHUC5HDBG25L+TlKzrz8D 4qvOmKMd0YYf+G4wGeHYp8/9UTw+AnC7DPHKCkaDtTpQJfZj/BGk+eC3TKjZ+vPGtYAT XoTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785726690; x=1786331490; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=r/saykZZ/5vcW+2cy8muslZqFNi+RNrcC1xh2TUTBUI=; b=gUBM4vf8oTciGJ6vjVkCZJ8SAzD2ApcUgfXbHzls1EltvInrW68pVSUjRJNrS12MMs nJiNScWP0BYZO0bnq2usHxUDLHxbGnkKY5PUtOOKZYAIYe1N+luyBoxIwvXT4qxRZL1q /dohOUziNHhDbF0PCTNfeNektTvzyRa476bdYVANMfRJBt80eNcEcvnSThWIY186maW+ OXi0cSYT0j1Q9LI78G4IxtOItdTdaqRfLLev97d8Dip2liJIfLPN+MjuVi9mPiYm/LCt XWfBHgC5OIX7I32DNHXw6z4q/z7nip+Me2WlDdYXVMY6XELBvpVONoWruIffdfv82fpp Hvww== X-Forwarded-Encrypted: i=1; AHgh+RpCozkQwggrJgValIZ+p9f2lYJEuJvUtM4SiTfGYks0qSGtHhyC1V/VItlsIQ5zzKKHigO+mY1PqK4kMeY=@vger.kernel.org X-Gm-Message-State: AOJu0Yz+E8xRFvhU4wAUa3ketAoAWVapvbi1RtH5hcgYSt/JQ1ugBcam Cv50byCaxMqV842vqdlV6tw2QYZIfCm9L1GfVAfK4868Qp7vdCLggfKX X-Gm-Gg: AR+sD11i7hCouaYtYIMmx+8yXT0krl6gu0esny8SO4QCZicLx0wqFpdOUEeZo87G0oP vAsWUlMSzynxCdEE7D4KvZvM2LBYx7gt07TWqnksW0ZIOAjZ2WY7sKVQvHarH+tXx/jvuGdOgF2 lAa25mVAJbB2pOEcdqsreRafl0CoWGHIcrunWVTgH4UOyW7YlHqw0kKWH2oaYiwNi0eZEEXcm5F co+KA3E0Sea+q+oPN1/wZOv9RVeTZCdIslwSRZoXNqbaw7aDBv1E35n5+XJ6Iiau6pBRFI5Dd0/ j3Aq+HsSVJkBYRuZxGp4Wxje/b6sRRiZxY5jQw7lsV59lEMWPgSbuo7CcnQc00RnPV/O8oob4uK 1DtZtbU2US2ub3CJT023NDeheErq0vjxFpFg9d5q/vZ9SmGkA8F9LbOgC3EmF23mS7Gzn1cCyo6 CE5UcgGeILZLf7MSAbiwH+RPLnsyNtCmygPI7AnyWqPDTZj+WPu1x/GwS6Xz7iICQgM++kDN3Ly uwioforPmctuFJPLu6bW8B5xzmylQ== X-Received: by 2002:a05:6a00:3d12:b0:84e:216d:7e52 with SMTP id d2e1a72fcca58-84ee479b0c4mr6605134b3a.14.1785726689723; Sun, 02 Aug 2026 20:11:29 -0700 (PDT) Received: from gmail.com ([138.199.21.246]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cbe39ea0a73sm2979886a12.23.2026.08.02.20.11.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 02 Aug 2026 20:11:29 -0700 (PDT) From: ZhengYuan Huang To: mark@fasheh.com, jlbec@evilplan.org, joseph.qi@linux.alibaba.com, tao.ma@oracle.com Cc: ocfs2-devel@lists.linux.dev, linux-kernel@vger.kernel.org, baijiaju1990@gmail.com, r33s3n6@gmail.com, zzzccc427@gmail.com, tom442288@tuta.io, ZhengYuan Huang Subject: [PATCH] ocfs2: validate global bitmap cl_bpc before resize Date: Mon, 3 Aug 2026 11:11:16 +0800 Message-ID: <20260803031116.3994362-1-gality369@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" [BUG] A corrupted global bitmap inode can make online group extension scan past the end of a group descriptor bitmap: BUG: KASAN: use-after-free in _find_next_bit+0xef/0x120 lib/find_bit.c:157 Read of size 8 at addr ffff888021b52000 by task syz.0.34/409 Call Trace: ... _find_next_bit+0xef/0x120 lib/find_bit.c:157 find_next_bit include/linux/find.h:73 [inline] find_next_bit_le include/linux/find.h:518 [inline] ocfs2_find_max_contig_free_bits+0x53/0xb0 fs/ocfs2/suballoc.c:1292 ocfs2_update_last_group_and_inode fs/ocfs2/resize.c:127 [inline] ocfs2_group_extend+0x83e/0x1ae0 fs/ocfs2/resize.c:350 ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 ... [CAUSE] ocfs2_group_extend() trusts the global bitmap dinode's cl_bpc value. If its high byte corrupted from zero to 0xc9 makes cl_bpc 51457. Extending by seven clusters narrows their product to a u16 value of 32519 and raises a 2048-bit group to 34567 bits, beyond its 32256-bit bitmap. The subsequent maximum-free-run scan then reads into the next page. [FIX] Reject a global bitmap whose cl_bpc is not one before using it in any resize arithmetic. The global allocator has exactly one bitmap bit per cluster, so this validates the invariant at the cold online-resize boundary and reports metadata corruption instead of enlarging bg_bits past the descriptor. Fixes: d659072f7368 ("[PATCH 1/2] ocfs2: Add group extend for online resize= ") Signed-off-by: ZhengYuan Huang --- fs/ocfs2/resize.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/resize.c b/fs/ocfs2/resize.c index 6375d5035972..556aaa319621 100644 --- a/fs/ocfs2/resize.c +++ b/fs/ocfs2/resize.c @@ -311,6 +311,14 @@ int ocfs2_group_extend(struct inode * inode, int new_c= lusters) goto out_unlock; } =20 + cl_bpc =3D le16_to_cpu(fe->id2.i_chain.cl_bpc); + if (cl_bpc !=3D 1) { + ret =3D ocfs2_error(main_bm_inode->i_sb, + "Invalid global bitmap bits per cluster %u\n", + cl_bpc); + goto out_unlock; + } + if (le16_to_cpu(fe->id2.i_chain.cl_cpg) !=3D ocfs2_group_bitmap_size(osb->sb, 0, osb->s_feature_incompat) * 8) { @@ -332,7 +340,6 @@ int ocfs2_group_extend(struct inode * inode, int new_cl= usters) } group =3D (struct ocfs2_group_desc *)group_bh->b_data; =20 - cl_bpc =3D le16_to_cpu(fe->id2.i_chain.cl_bpc); if (le16_to_cpu(group->bg_bits) / cl_bpc + new_clusters > le16_to_cpu(fe->id2.i_chain.cl_cpg)) { ret =3D -EINVAL; --=20 2.43.0