Re: [PATCH] ext4: fix OOB write in fast-commit replay

[Jérémy Jean]

On 2026-11-09 14:19, Jan Kara wrote:
> On Sun 08-11-26 20:43:46, Jérémy Jean wrote:
> > Fast-commit recovery checks record bounds and lengths during scan.
> > Replay reads the records again without these checks. A corrupt 
> > filesystem
> > can make an earlier replay operation overwrite a later record. Its new
>
> This fact looks like the real problem. I think we should validate the
> replay does not corrupt the journal. How does this happen? Otherwise we
> have to fully redo the validation of each record done in
> ext4_fc_replay_scan().

The replay can corrupt the journal because a corrupted image can make
metadata blocks used during replay overlap with fast-commit blocks. I
agree that making sure that replay does not corrupt the journal would
be a stronger fix, but I'm not sure I see a simple way to fix this
properly. Rechecking bounds as I proposed fixes a memory issue but it
indeed does not address the root cause.

Regards,
Jérémy