Re: [PATCH v2] ext4: Fix possible use-after-free in ext4_find_extent

[Tudor Ambarus]

On 30.12.2022 22:07, Eric Biggers wrote:
> On Fri, Dec 30, 2022 at 01:42:45PM +0200, Tudor Ambarus wrote:
> > Seems that __ext4_iget() is not called on writes.
>
> It is called when the inode is first accessed.  Usually that's when the file is
> opened.

Okay, thanks.

> So the question is why didn't it validate the inode's extent header, or
> alternatively how did the inode's extent header get corrupted afterwards.
>
> > You can find below the sequence of calls that leads to the bug.
>
> A stack trace is not a reproducer.  Things must have happened before that point.

I will try to dig more to understand what's happening. If you like to
take a look into the reproducer, here it is:
https://syzkaller.appspot.com/text?tag=ReproC&x=17beb560480000

The reproducer was used for Android 5.15 and the bug is reported at [1],
but as I mentioned earlier, using the same reproducer and config I hit
the bug on v6.2-rc1 as well.

Thanks for the help.
ta

[1] 
https://syzkaller.appspot.com/bug?id=be6e90ce70987950e6deb3bac8418344ca8b96cd