On 30.12.2022 22:07, Eric Biggers wrote:
On Fri, Dec 30, 2022 at 01:42:45PM +0200, Tudor Ambarus wrote:
Seems that __ext4_iget() is not called on writes.
It is called when the inode is first accessed. Usually that's when the file is
opened.
Okay, thanks.
So the question is why didn't it validate the inode's extent header, or
alternatively how did the inode's extent header get corrupted afterwards.
You can find below the sequence of calls that leads to the bug.
A stack trace is not a reproducer. Things must have happened before that point.
I will try to dig more to understand what's happening. If you like to
take a look into the reproducer, here it is:
https://syzkaller.appspot.com/text?tag=ReproC&x=17beb560480000
The reproducer was used for Android 5.15 and the bug is reported at [1],
but as I mentioned earlier, using the same reproducer and config I hit
the bug on v6.2-rc1 as well.
Thanks for the help.
ta
[1]
https://syzkaller.appspot.com/bug?id=be6e90ce70987950e6deb3bac8418344ca8b96cd
