On 2026-10-28T05:50:47, Ana Bobillo <[email protected]> wrote: > fs: ext4: check block numbers before releasing them > > When ext4fs_write() replaces an existing file, ext4fs_delete_file() > releases the file's blocks: the data blocks found by > read_allocated_block() and, for a file using indirect blocks, the > blocks listed in its indirect blocks. Each block number comes from the > inode or from an indirect block on disk and is turned into a block > group index used for fs->blk_bmaps[] and ext4fs_get_group_descriptor() > without any check. A block number past the end of the filesystem > makes ext4fs_reset_block_bmap() and ext4fs_bg_free_blocks_inc() write > outside the bitmap array and the group descriptor table. > > Add ext4fs_blk_to_group(), which computes the block group of a block > as Linux ext4_get_group_no_and_offset() does, from the first data > block. As Linux does, it rejects a block that does not lie after the > first data block, which holds the superblock, and before the end of the > filesystem. Use it wherever the delete path computes the block group of > a block, in place of the open-coded division whose special case for > 1 KiB blocks stood in for a first data block of 1. > > Make the delete_*_indirect_block() helpers return an error, so that > ext4fs_delete_file() stops rather than releasing blocks of a corrupt > inode: -EINVAL for an invalid block number, -ENOMEM when out of > memory and -EIO when a read or the journal fails. That includes the > reads of the double and triple indirect blocks and of the blocks the > triple indirect block lists, which used to be unchecked: when one > failed, the zeroed buffer ended the walk at once, so the indirect block > was released and the blocks listed in it were leaked. > > Signed-off-by: Ana Bobillo <[email protected]> > > fs/ext4/ext4_common.c | 35 +++++++++++++++ > fs/ext4/ext4_common.h | 1 + > fs/ext4/ext4_write.c | 115 > ++++++++++++++++++++++++++------------------------ > 3 files changed, 97 insertions(+), 54 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
