[BUG] ext2: WARNING in ext2_get_group_desc when allocating a block

[BUG] ext2: WARNING in ext2_get_group_desc when allocating a block

[CJ]

Hi,


I am reporting an issue triggered by a syzkaller reproducer on Linux
7.3.0-rc2. The issue is reproducible with HEAD commit
df2908090cda368b01ff43709f51890076c56157.


The reproducer mounts a crafted ext2 image carrying user_xattr options,
turns quota accounting on for it through a loop device, and then performs a
write on a file in that filesystem. Extending the file makes ext2 allocate a
fresh block, which is where the failure is reached.


While allocating, ext2 derives the target block group from the block mapping
fields of the mounted image and looks that group up with
ext2_get_group_desc(). The group number it computes lies past the last group
recorded in the superblock, so the range check in ext2_get_group_desc()
reports it. The syscall context is a plain write from the syzkaller task;
the call path runs ext2_new_blocks() -> ext2_get_blocks() ->
ext2_get_block() -> __block_write_begin_int() -> block_write_begin() ->
ext2_write_begin() -> generic_perform_write().


This looks like an on-disk block number that points outside the filesystem
being accepted while the file is extended. ext2_get_blocks() is the place
that turns a logical block into a physical one for an existing mapping, and
the resulting physical block is then used as the basis for the group lookup
in ext2_new_blocks() without an earlier bounds check catching it. I have not
traced which specific mapping field carries the out-of-range value, so
treating the missing validation in the mapping path as the candidate would
need confirmation from someone familiar with the allocator.


This failure was reported earlier against the linux-6.1 longterm series at
https://syzkaller.appspot.com/bug?extid=00ce9ece44d395606bae, and the
reproducer below is the one from that report. It still reproduces on the
tested mainline kernel.


Reproducer:


syz reproducer:  https://pastebin.com/raw/CLDCSLZj

console output: https://pastebin.com/raw/WLKWyEEf

kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=872c04466179833f


Kernel:


HEAD commit: df2908090cda368b01ff43709f51890076c56157
git tree: mainline
kernel version: 7.3.0-rc2
tested tag: v7.3-rc2 (annotated tag object 5e036ce12de91c6fd674dad33b169c6150be2a7a)


Let me know if you need more details or testing.


Best regards,
Changjian Liu