From nobody Mon Dec 15 18:56:42 2025 Received: from mail-io1-f71.google.com (mail-io1-f71.google.com [209.85.166.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 820C630C34E for ; Wed, 29 Oct 2025 06:27:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.166.71 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761719268; cv=none; b=tylOfJqhVi4YYwPL8urwRmY85sitLRPgdqa6afS1dbTSMMcHUcxsIJlPPe+ptEV1o9dP2Cm7GIKSxWCe8x+aGyzZ60F27q0KG9mah4qj26Xx/+hCoPex0XZuxx2TN7n63+49PWuN9e5oXnGRYHe3NUvfX2Na7okmSvBkeWjmbRM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761719268; c=relaxed/simple; bh=MHk0VGoORqSwLv64h4cOzEUN4Mamvjo88LN3fRF9PGA=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=qTFLnkX+bx3zYouJ+Ev9xss+0n0j7O9a+TasH8R6oU7BYi22mIgSMHGVLkQCvwCftNNBt37w8SAWwrjbPOeUjhtgBNg0gChsqhdPf/W9krR9EyLmvnUylXd4m01ZTrMqQFP2+atGfBBUqT++BJT1IwOu1UT0yk7Z8qY/0awOZPs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.166.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-io1-f71.google.com with SMTP id ca18e2360f4ac-945ab8d3d0bso341292539f.2 for ; Tue, 28 Oct 2025 23:27:46 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1761719265; x=1762324065; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=lPETPdnmj6lHNQGDjl39LsiEXpLbvR2j7XmdxR2Bghg=; b=ZZKpSELX3xZYpz+eIvwJ39e3D/HzpZW2PJKLyA3PEF+eYPCDl5cjRuIL7Pfv0PK1yZ G0aY/L2+rez0v2ol+rUjugXoPGQjqeeJ+yNHA7CUP7WokW2ZUi3jdBP6YZyvwv4fCQhh s9qukV62+MXtriUsRwwzSFVoDwmV5BJFwMA30LvehcuWLrqjy4D4JCXFyJD+Zxg9DvHw GHcrpRmA/rTumqTyLUEyetbGj3kwlJzbwxFlHinGHkGew7iVwvLDaaOk1vmyzGJzYoK7 Ju1GOiSYpc+5IOmXVeuqXuv0n67AYKHxsUPoiQRIQDBbcta2DHCrZZtr7MRgb3prToRS G3+Q== X-Gm-Message-State: AOJu0YzF7MIzs4/YHq1Bz2MIIybC3amYAuDVhaChkN0GFypHEHUQYVSK SqDZ34PkWEjqtw4bIHSzNSeVFIoBETiLkpJA8R2Z9628P5SevMlP8XF06Tuhuf0y7Ve+bvo0tls wSjOcgFCzl2rBeuUJQUAxA4P5gY/nnYnUT1trl3NgBzTfjPQO0n2VPaBOytQ= X-Google-Smtp-Source: AGHT+IEYA+cMVk7KZU1B4Hhe/5N0vyUksa61W9O0B0WqV0qlr1iIpu7CawgsDFz6XrJYTZZ9oo3IoqIy3WUjLaQ7WxOsko3JQ15s Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6e02:184c:b0:431:f808:622b with SMTP id e9e14a558f8ab-432f8f81c61mr24901485ab.1.1761719265680; Tue, 28 Oct 2025 23:27:45 -0700 (PDT) Date: Tue, 28 Oct 2025 23:27:45 -0700 In-Reply-To: <675e5ede.050a0220.37aaf.00ed.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6901b3e1.050a0220.32483.01fc.GAE@google.com> Subject: Forwarded: #syz test https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.12.y From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: #syz test https://git.kernel.org/pub/scm/linux/kernel/git/stable/l= inux.git linux-6.12.y Author: dmantipov@yandex.ru diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c index 5d9388b44e5b..b84e164c6314 100644 --- a/fs/ocfs2/alloc.c +++ b/fs/ocfs2/alloc.c @@ -6162,6 +6162,9 @@ static int ocfs2_get_truncate_log_info(struct ocfs2_s= uper *osb, int status; struct inode *inode =3D NULL; struct buffer_head *bh =3D NULL; + struct ocfs2_dinode *di; + struct ocfs2_truncate_log *tl; + unsigned int tl_count, tl_used; =20 inode =3D ocfs2_get_system_file_inode(osb, TRUNCATE_LOG_SYSTEM_INODE, @@ -6179,6 +6182,19 @@ static int ocfs2_get_truncate_log_info(struct ocfs2_= super *osb, goto bail; } =20 + di =3D (struct ocfs2_dinode *)bh->b_data; + tl =3D &di->id2.i_dealloc; + tl_used =3D le16_to_cpu(tl->tl_used); + tl_count =3D le16_to_cpu(tl->tl_count); + if (unlikely(tl_count > ocfs2_truncate_recs_per_inode(osb->sb) || + tl_count =3D=3D 0 || tl_used > tl_count)) { + status =3D -EFSCORRUPTED; + iput(inode); + brelse(bh); + mlog_errno(status); + goto bail; + } + *tl_inode =3D inode; *tl_bh =3D bh; bail: diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c index 7799f4d16ce9..46f392374388 100644 --- a/fs/ocfs2/dir.c +++ b/fs/ocfs2/dir.c @@ -302,8 +302,21 @@ static int ocfs2_check_dir_entry(struct inode *dir, unsigned long offset) { const char *error_msg =3D NULL; - const int rlen =3D le16_to_cpu(de->rec_len); - const unsigned long next_offset =3D ((char *) de - buf) + rlen; + unsigned long next_offset; + int rlen; + + if (offset > size - OCFS2_DIR_REC_LEN(1)) { + /* Dirent is (maybe partially) beyond the buffer + * boundaries so touching 'de' members is unsafe. + */ + mlog(ML_ERROR, "directory entry (#%llu: offset=3D%lu) " + "too close to end or out-of-bounds", + (unsigned long long)OCFS2_I(dir)->ip_blkno, offset); + return 0; + } + + rlen =3D le16_to_cpu(de->rec_len); + next_offset =3D ((char *) de - buf) + rlen; =20 if (unlikely(rlen < OCFS2_DIR_REC_LEN(1))) error_msg =3D "rec_len is smaller than minimal"; @@ -778,6 +791,14 @@ static int ocfs2_dx_dir_lookup_rec(struct inode *inode, struct ocfs2_extent_block *eb; struct ocfs2_extent_rec *rec =3D NULL; =20 + if (le16_to_cpu(el->l_count) !=3D + ocfs2_extent_recs_per_dx_root(inode->i_sb)) { + ret =3D ocfs2_error(inode->i_sb, + "Inode %lu has invalid extent list length %u\n", + inode->i_ino, le16_to_cpu(el->l_count)); + goto out; + } + if (el->l_tree_depth) { ret =3D ocfs2_find_leaf(INODE_CACHE(inode), el, major_hash, &eb_bh); @@ -3415,6 +3436,14 @@ static int ocfs2_find_dir_space_id(struct inode *dir= , struct buffer_head *di_bh, offset +=3D le16_to_cpu(de->rec_len); } =20 + if (!last_de) { + ret =3D ocfs2_error(sb, "Directory entry (#%llu: size=3D%lld) " + "is unexpectedly short", + (unsigned long long)OCFS2_I(dir)->ip_blkno, + i_size_read(dir)); + goto out; + } + /* * We're going to require expansion of the directory - figure * out how many blocks we'll need so that a place for the diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c index 4a7509389cf3..e226219a0798 100644 --- a/fs/ocfs2/inode.c +++ b/fs/ocfs2/inode.c @@ -1419,6 +1419,39 @@ int ocfs2_validate_inode_block(struct super_block *s= b, goto bail; } =20 + if (le32_to_cpu(di->i_flags) & OCFS2_CHAIN_FL) { + struct ocfs2_chain_list *cl =3D &di->id2.i_chain; + u16 bpc =3D 1 << (OCFS2_SB(sb)->s_clustersize_bits - + sb->s_blocksize_bits); + + if (le16_to_cpu(cl->cl_count) !=3D ocfs2_chain_recs_per_inode(sb)) { + rc =3D ocfs2_error(sb, "Invalid dinode %llu: chain list count %u\n", + (unsigned long long)bh->b_blocknr, + le16_to_cpu(cl->cl_count)); + goto bail; + } + if (le16_to_cpu(cl->cl_next_free_rec) > le16_to_cpu(cl->cl_count)) { + rc =3D ocfs2_error(sb, "Invalid dinode %llu: chain list index %u\n", + (unsigned long long)bh->b_blocknr, + le16_to_cpu(cl->cl_next_free_rec)); + goto bail; + } + if (le16_to_cpu(cl->cl_bpc) !=3D bpc) { + rc =3D ocfs2_error(sb, "Invalid dinode %llu: bits per cluster %u\n", + (unsigned long long)bh->b_blocknr, + le16_to_cpu(cl->cl_bpc)); + goto bail; + } + } + + if ((le16_to_cpu(di->i_dyn_features) & OCFS2_INLINE_DATA_FL) && + le32_to_cpu(di->i_clusters)) { + rc =3D ocfs2_error(sb, "Invalid dinode %llu: %u clusters\n", + (unsigned long long)bh->b_blocknr, + le32_to_cpu(di->i_clusters)); + goto bail; + } + rc =3D 0; =20 bail: diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c index f9d6a4f9ca92..b10c8acd469b 100644 --- a/fs/ocfs2/move_extents.c +++ b/fs/ocfs2/move_extents.c @@ -98,7 +98,13 @@ static int __ocfs2_move_extent(handle_t *handle, =20 rec =3D &el->l_recs[index]; =20 - BUG_ON(ext_flags !=3D rec->e_flags); + if (ext_flags !=3D rec->e_flags) { + ret =3D ocfs2_error(inode->i_sb, + "Inode %llu has corrupted extent %d with flags 0x%x at cpos %u\n", + (unsigned long long)ino, index, rec->e_flags, cpos); + goto out; + } + /* * after moving/defraging to new location, the extent is not going * to be refcounted anymore. @@ -1032,6 +1038,12 @@ int ocfs2_ioctl_move_extents(struct file *filp, void= __user *argp) if (range.me_threshold > i_size_read(inode)) range.me_threshold =3D i_size_read(inode); =20 + if (range.me_flags & ~(OCFS2_MOVE_EXT_FL_AUTO_DEFRAG | + OCFS2_MOVE_EXT_FL_PART_DEFRAG)) { + status =3D -EINVAL; + goto out_free; + } + if (range.me_flags & OCFS2_MOVE_EXT_FL_AUTO_DEFRAG) { context->auto_defrag =3D 1;