ocfs2_local_read_info() trusts dqi_chunks and dqi_blocks from the local
quota file header.  If dqi_blocks is too small,
ocfs2_extend_local_quota_file() computes a bogus chunk length, extends the
file, and maps logical block dqi_blocks, which is already in the inode's
metadata cache (the header or a chunk header read at mount).  sb_getblk()
returns that cached buffer and ocfs2_set_new_buffer_uptodate() hits
BUG_ON(ocfs2_buffer_cached()):

  kernel BUG at fs/ocfs2/uptodate.c:509!
  ocfs2_extend_local_quota_file+0x45c/0x1100
  ocfs2_create_local_dquot+0x8ac/0xb50
  ocfs2_acquire_dquot+0x614/0xae0
  ocfs2_get_init_inode+0xe9/0x1b0
  ocfs2_mkdir+0x174/0x430

ocfs2_local_quota_add_chunk() has the same exposure.

Reject a header whose counts don't fit the chunk layout or exceed i_size.

Reproduced with a crafted image (dqi_blocks = 1, chunk 0 dqc_free = 0);
syzbot has no reproducer for this report.

Reported-by: syzbot+03aaa576f1daa1c1f2f0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=03aaa576f1daa1c1f2f0
Fixes: 9e33d69f553a ("ocfs2: Implementation of local and global quota file handling")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
 fs/ocfs2/quota_local.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index f55810c59b1b..1c9afe38e40e 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -245,6 +245,25 @@ static void ocfs2_release_local_quota_bitmaps(struct list_head *head)
 	}
 }
 
+/* Check that the on-disk chunk and block counts match the file layout */
+static int ocfs2_check_local_quota_info(struct inode *inode,
+					unsigned int chunks,
+					unsigned int blocks)
+{
+	u64 chunk_len = ol_chunk_blocks(inode->i_sb) + 1;
+	u64 min_blocks = chunks ? 1 + chunk_len * (chunks - 1) + 1 : 1;
+	u64 max_blocks = 1 + chunk_len * chunks;
+
+	if (blocks >= min_blocks && blocks <= max_blocks &&
+	    blocks <= i_size_read(inode) >> inode->i_sb->s_blocksize_bits)
+		return 0;
+
+	return ocfs2_error(inode->i_sb,
+			   "Quota file %llu has bad info: %u chunks, %u blocks\n",
+			   (unsigned long long)OCFS2_I(inode)->ip_blkno,
+			   chunks, blocks);
+}
+
 /* Load quota bitmaps into memory */
 static int ocfs2_load_local_quota_bitmaps(struct inode *inode,
 			struct ocfs2_local_disk_dqinfo *ldinfo,
@@ -733,6 +752,11 @@ static int ocfs2_local_read_info(struct super_block *sb, int type)
 	oinfo->dqi_blocks = le32_to_cpu(ldinfo->dqi_blocks);
 	oinfo->dqi_libh = bh;
 
+	status = ocfs2_check_local_quota_info(lqinode, oinfo->dqi_chunks,
+					      oinfo->dqi_blocks);
+	if (status < 0)
+		goto out_err;
+
 	/* We crashed when using local quota file? */
 	if (!(oinfo->dqi_flags & OLQF_CLEAN)) {
 		rec = OCFS2_SB(sb)->quota_rec;
-- 
2.43.0

On 9/20/26 10:07 PM, Nguyen Ngoc Thang wrote:
> ocfs2_local_read_info() trusts dqi_chunks and dqi_blocks from the local
> quota file header.  If dqi_blocks is too small,
> ocfs2_extend_local_quota_file() computes a bogus chunk length, extends the
> file, and maps logical block dqi_blocks, which is already in the inode's
> metadata cache (the header or a chunk header read at mount).  sb_getblk()
> returns that cached buffer and ocfs2_set_new_buffer_uptodate() hits
> BUG_ON(ocfs2_buffer_cached()):
> 
>   kernel BUG at fs/ocfs2/uptodate.c:509!
>   ocfs2_extend_local_quota_file+0x45c/0x1100
>   ocfs2_create_local_dquot+0x8ac/0xb50
>   ocfs2_acquire_dquot+0x614/0xae0
>   ocfs2_get_init_inode+0xe9/0x1b0
>   ocfs2_mkdir+0x174/0x430
> 
> ocfs2_local_quota_add_chunk() has the same exposure.
> 
> Reject a header whose counts don't fit the chunk layout or exceed i_size.
> 
> Reproduced with a crafted image (dqi_blocks = 1, chunk 0 dqc_free = 0);
> syzbot has no reproducer for this report.
> 
> Reported-by: syzbot+03aaa576f1daa1c1f2f0@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=03aaa576f1daa1c1f2f0
> Fixes: 9e33d69f553a ("ocfs2: Implementation of local and global quota file handling")
> Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>

Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>

> ---
>  fs/ocfs2/quota_local.c | 24 ++++++++++++++++++++++++
>  1 file changed, 24 insertions(+)
> 
> diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
> index f55810c59b1b..1c9afe38e40e 100644
> --- a/fs/ocfs2/quota_local.c
> +++ b/fs/ocfs2/quota_local.c
> @@ -245,6 +245,25 @@ static void ocfs2_release_local_quota_bitmaps(struct list_head *head)
>  	}
>  }
>  
> +/* Check that the on-disk chunk and block counts match the file layout */
> +static int ocfs2_check_local_quota_info(struct inode *inode,
> +					unsigned int chunks,
> +					unsigned int blocks)
> +{
> +	u64 chunk_len = ol_chunk_blocks(inode->i_sb) + 1;
> +	u64 min_blocks = chunks ? 1 + chunk_len * (chunks - 1) + 1 : 1;
> +	u64 max_blocks = 1 + chunk_len * chunks;
> +
> +	if (blocks >= min_blocks && blocks <= max_blocks &&
> +	    blocks <= i_size_read(inode) >> inode->i_sb->s_blocksize_bits)
> +		return 0;
> +
> +	return ocfs2_error(inode->i_sb,
> +			   "Quota file %llu has bad info: %u chunks, %u blocks\n",
> +			   (unsigned long long)OCFS2_I(inode)->ip_blkno,
> +			   chunks, blocks);
> +}
> +
>  /* Load quota bitmaps into memory */
>  static int ocfs2_load_local_quota_bitmaps(struct inode *inode,
>  			struct ocfs2_local_disk_dqinfo *ldinfo,
> @@ -733,6 +752,11 @@ static int ocfs2_local_read_info(struct super_block *sb, int type)
>  	oinfo->dqi_blocks = le32_to_cpu(ldinfo->dqi_blocks);
>  	oinfo->dqi_libh = bh;
>  
> +	status = ocfs2_check_local_quota_info(lqinode, oinfo->dqi_chunks,
> +					      oinfo->dqi_blocks);
> +	if (status < 0)
> +		goto out_err;
> +
>  	/* We crashed when using local quota file? */
>  	if (!(oinfo->dqi_flags & OLQF_CLEAN)) {
>  		rec = OCFS2_SB(sb)->quota_rec;