Re: [PATCH] ocfs2: validate non-coherent freefrag bitmap inode

[Joseph Qi]

On 10/18/26 7:41 PM, Jiale Yao wrote:
> The non-coherent freefrag ioctl path reads the global bitmap inode
> directly and trusts its chain list. A malformed cl_next_free_rec value
> can therefore index beyond cl_recs while scanning chains.
> 

Could you  provide the detailed bug report?

> Validate the inode block before consuming its bitmap and chain metadata.
> 
> Fixes: d24a10b9f8ed ("Ocfs2: Add a new code 'OCFS2_INFO_FREEFRAG' for o2info ioctl.")
> Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
> ---
>  fs/ocfs2/ioctl.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
> index cbe59d231666..8383f900c847 100644
> --- a/fs/ocfs2/ioctl.c
> +++ b/fs/ocfs2/ioctl.c
> @@ -575,6 +575,12 @@ static int ocfs2_info_freefrag_scan_bitmap(struct ocfs2_super *osb,
>  			mlog_errno(status);
>  			goto bail;
>  		}
> +
> +		status = ocfs2_validate_inode_block(osb->sb, bh);
> +		if (status < 0) {
> +			mlog_errno(status);
> +			goto bail;
> +		}

ocfs2_validate_inode_block() only validates cl_next_free_rec when
on-disk dinode has OCFS2_CHAIN_FL set. So a crafted global bitmap block
without that flag still lets the freefrag chain walk index past cl_recs[]
and read out of bounds from the buffer_head.

Thanks,
Joseph

>  	}
>  
>  	gb_dinode = (struct ocfs2_dinode *)bh->b_data;