From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7C24D1E1DF0 for ; Tue, 4 Aug 2026 04:55:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785819338; cv=none; b=ZGrHnrxcUsizZKFJQuEmxMDLAL9XR95uDU9+ugImRIZy69xOG+l/zy0kOQYQ7L7/DIbIK019iUH1nsFu3NojM0GSwqXf0lQdm4k0kKBnPl+kkTX7YWOsT7YOmFICDwkUFaoizqNEMWH3nR5o6D03o3/dVIFC8MLKRh4vU17hyD4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785819338; c=relaxed/simple; bh=iV2nAHfGhDwkMGCRqBFtmMrC9pjdP1du9lckNNaqVYk=; h=Message-ID:Date:MIME-Version:To:Cc:From:Subject:Content-Type; b=MhwHHL4mDIbTPFu0PWcGQHsXj53jV5LJEGUgNBFj6xoHKd5lGTTSZwpk3F4/lbub1Rb+avENI7+ARE+nHpDqR6tNFlmCuzQ8qYu4z45iOl+GBHO3kIeJzFCd8vXgOBaTP18sUgOiNI+A1tAaoq1IRNToDH0kdWaDL3Oe7MBehHM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lDz/9Vk7; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lDz/9Vk7" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2d03fcd26a6so2983585ad.2 for ; Mon, 03 Aug 2026 21:55:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785819337; x=1786424137; darn=vger.kernel.org; h=content-transfer-encoding:content-type:subject:from:cc:to :content-language:user-agent:mime-version:date:message-id:from:to:cc :subject:date:message-id:reply-to:content-type; bh=LjdXQJGz+lwElkC0697Bamhm02fodNd9qx878yCNFEw=; b=lDz/9Vk7B02QQ/3qzDtk5wA+6SdRLexqNKSDu8o/SEmqwbi/xZQX/yfMKBtPFbclYc sisXmVNEBL+2QBhBtxf0tOa9B8RGfHdBdGBilMiVcAKHF0te9p65M+XL7R8L/CJNq+Ij SjAYAi5rXidj3s0nRdhMrUi0tU3uhVJd/T9Yd4od2A8V17O+g4jZ7qgr2kwRkyBUPanN vGqS+IlvMEyxUJP1h6Gm+6bHxUURLKev8Q5mpPp5MQw9o2GZ3DsGSvUaQJl/3IwBZKoW Gtfv8EQcNMfPFr2wgbf90dG2r8PKdt9K3oe040gQz8mfG0t3QmSafMzeY/I2V/0ntzZp ykmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785819337; x=1786424137; h=content-transfer-encoding:content-type:subject:from:cc:to :content-language:user-agent:mime-version:date:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=LjdXQJGz+lwElkC0697Bamhm02fodNd9qx878yCNFEw=; b=Kb01lHxgB/vAs+iCXYyJPbn9p3eIHJtUXx+aGnu126Z2/1mmH3YCR2+fo0NHU9IRSQ GHJxgG4ezvHSZp1jSzAxfqGXXyp2sRNTay/CRm+0bCpUxzVzyIm+HCKBpUqBUk+mVKwX gdCt4MBtnmIS4Z7NJY2xspH2+qiP4uMS7yLY8sdSExW2ZBJoWDxqXA1bfbqmES5rZOS/ GgqQMZAn+HMCZwKzOjiUEQ+lKDd4Jfk7oI6TBQXlIssfYgvIJ7A8pU3Lg1Rqfy6+avzJ tgR/iZUrQ47XBbxvNPyKf2RlVph3NbIq+KOnPHCLXEi6qbisZbesyrCGsWC/KhN3giMw 8g2A== X-Forwarded-Encrypted: i=1; AHgh+RojHEZIkO4DbrzijPDFsH+uzafJ0jHZLHcI+uASiqcCRFmLHc+UfvB5v4IDRonNm0/n2h52G9R9w3nuG+M=@vger.kernel.org X-Gm-Message-State: AOJu0YwiJPEd6fm7x7s3pJH2/j4LENat7WaDy9xwl2WXLSkrpnEsNSfL jAxsVr+ZOmDcysV2EgbagNcfR0iedfLuOySx/vZ/ZPI5Yhx0cZmPd1c9QvbKaJah X-Gm-Gg: AR+sD11NcrP3SqPfR5e+dBvpsfIJzzbjBwWWeY6Q5AhkPKSuWgmEpI7he7PM02JLiFD BCtH8hgmWc/T4gGtzcnPGuOP0Fsem8S8mudA2ri8clSfjwg4x35SNbzot3bwLEdKiGF5/9o78QS WMimJkhNcXgE/VbuJ3YhzTPr7tuv/XBPIVb5MhG8htaowxZc8jok0qdrhgm++Prac3koJNg1YNK P2YmdO9cpMXTY509DGsDkP3sLwJs6drLUtNICUXti+UB2MOCKemCxkHebujaMEcrvpxfCr7Mhjm CP1kEdJSZLrdwwz5xcfLF8580GxBvLYh3NSLwgzrfo+XZejvfMVMCvLaHZaTpzRaVDCZeKavYId +/wpaELXvtwF47zEVsalaX6CZHHIrCvDEdLV8XcpsouA1HI1bcuR3gkjunjK73I4Eb+zPgnfD9l bZObjhfFXdqQlSdAc9SNTe+4g1ciZddX8Eu1VRIf0SY7VmmwvwQyqe2kFsK2SiT8R3KiW1xbbfb yMOVbB4j0mVUQ== X-Received: by 2002:a17:90b:3a10:b0:38e:91a8:fb85 with SMTP id 98e67ed59e1d1-38fbc507730mr15816320a91.3.1785819336654; Mon, 03 Aug 2026 21:55:36 -0700 (PDT) Received: from [10.70.111.138] ([202.189.104.49]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38feda512f3sm645617a91.11.2026.08.03.21.55.34 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 03 Aug 2026 21:55:35 -0700 (PDT) Message-ID: <65c955b0-716b-4599-b925-59c2782e38b4@gmail.com> Date: Tue, 4 Aug 2026 12:55:33 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: Theodore Ts'o , Andreas Dilger Cc: linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org From: Junzhe Yu Subject: [PATCH] ext4: guard against NULL s_group_info in ext4_get_group_info Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Resend: previous attempt was rejected by vger for containing HTML. ================================================================== ext4_mark_group_bitmap_corrupted() already treats a NULL return from ext4_get_group_info() as "nothing to do", but ext4_get_group_info() indexes s_group_info without checking whether the array exists. During mount, fast-commit replay runs inside jbd2_journal_load() from ext4_load_and_init_journal(), which is before ext4_mb_init() allocates s_group_info. Replaying an FC UNLINK for an inode whose bitmap bit is already clear takes:   ext4_fc_replay_unlink -> iput -> ext4_evict_inode -> ext4_free_inode     -> ext4_mark_group_bitmap_corrupted -> ext4_get_group_info and faults on the NULL s_group_info base. Userspace only mounts a dirty ext4 image; this is a supported recovery path. Return NULL when s_group_info (or the per-block grp_info row) is unset so the existing caller check is effective during early mount. Tested on Linux v6.6.145 KASAN: crafted FC-unlink image previously triggered KASAN null-ptr-deref / panic in ext4_get_group_info; with this patch, mount succeeds (EXT4 "bit already cleared" may still log). Also observed on v6.6.144; still present on torvalds/linux as of f5098b6bae76 (2026-07-26). A self-contained Docker/QEMU reproducer (craft + mount + patch verify) is available on request. Signed-off-by: Yu Junzhe ---  fs/ext4/balloc.c | 4 ++++  1 file changed, 4 insertions(+) diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c index 3a2dfc5..80c81bc 100644 --- a/fs/ext4/balloc.c +++ b/fs/ext4/balloc.c @@ -329,9 +329,13 @@ struct ext4_group_info *ext4_get_group_info(struct super_block *sb,      if (unlikely(group >= EXT4_SB(sb)->s_groups_count))          return NULL; +    if (unlikely(!EXT4_SB(sb)->s_group_info)) +        return NULL;      indexv = group >> (EXT4_DESC_PER_BLOCK_BITS(sb));      indexh = group & ((EXT4_DESC_PER_BLOCK(sb)) - 1);      grp_info = sbi_array_rcu_deref(EXT4_SB(sb), s_group_info, indexv); +    if (unlikely(!grp_info)) +        return NULL;      return grp_info[indexh];  } -- 2.53.0