Re: [PATCH 4/4] ocfs2: validate suballoc slot of extent blocks

[Heming Zhao]

On Mon, Aug 31, 2026 at 02:28:48PM +0800, Joseph Qi wrote:
> ocfs2_validate_extent_block() does not validate h_suballoc_slot against
> the mounted filesystem's slot range.  Since extent blocks are allocated
> from a per-slot suballocator at runtime, their suballoc slot must be
> within range.
> 
> Otherwise a corrupted image can carry an out-of-range slot.  When the
> extent block is freed, ocfs2_cache_extent_block_free() caches it and
> ocfs2_free_cached_blocks() later passes the unvalidated slot to
> ocfs2_get_system_file_inode(), so get_local_system_inode() will either
> hit BUG_ON(slot == OCFS2_INVALID_SLOT) or compute an out-of-bounds
> index into the local_system_inodes array.
> 
> Reject out-of-range suballoc slots during validation.
> 
> Signed-off-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>

LGTM.
Reviewed-by: Heming Zhao <heming.zhao@xxxxxxxx>
> ---
>  fs/ocfs2/alloc.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
> index be09e766ac1f..2abd242a438f 100644
> --- a/fs/ocfs2/alloc.c
> +++ b/fs/ocfs2/alloc.c
> @@ -925,6 +925,20 @@ static int ocfs2_validate_extent_block(struct super_block *sb,
>  		goto bail;
>  	}
>  
> +	/*
> +	 * Extent blocks are allocated from a per-slot suballocator, so the
> +	 * slot must be in range.  Otherwise freeing the block passes it to
> +	 * get_local_system_inode(), which hits BUG_ON() for
> +	 * OCFS2_INVALID_SLOT or computes an out-of-bounds index otherwise.
> +	 */
> +	if ((u32)le16_to_cpu(eb->h_suballoc_slot) >= OCFS2_SB(sb)->max_slots) {
> +		rc = ocfs2_error(sb,
> +				 "Extent block #%llu has an invalid h_suballoc_slot of %u\n",
> +				 (unsigned long long)bh->b_blocknr,
> +				 le16_to_cpu(eb->h_suballoc_slot));
> +		goto bail;
> +	}
> +
>  	if (le16_to_cpu(eb->h_list.l_count) != ocfs2_extent_recs_per_eb(sb)) {
>  		rc = ocfs2_error(sb,
>  				 "Extent block #%llu has invalid l_count %u (expected %u)\n",
> -- 
> 2.39.3
>