From patchwork Tue May 12 07:49:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junrui Luo X-Patchwork-Id: 2236717 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=outlook.com header.i=@outlook.com header.a=rsa-sha256 header.s=selector1 header.b=Lii4kGvQ; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=ozlabs.org (client-ip=2404:9400:2221:ea00::3; helo=mail.ozlabs.org; envelope-from=srs0=fjjf=dj=vger.kernel.org=linux-ext4+bounces-16477-patchwork-incoming=ozlabs.org@ozlabs.org; receiver=patchwork.ozlabs.org) Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4gF8690wC8z1yHx for ; Tue, 12 May 2026 17:55:44 +1000 (AEST) Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by gandalf.ozlabs.org (Postfix) with ESMTP id 4gF8682nn6z4wTN for ; Tue, 12 May 2026 17:55:44 +1000 (AEST) Received: by gandalf.ozlabs.org (Postfix) id 4gF8682YFfz4wLX; Tue, 12 May 2026 17:55:44 +1000 (AEST) Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: gandalf.ozlabs.org; arc=fail smtp.remote-ip="2600:3c04:e001:36c::12fc:5321" Authentication-Results: gandalf.ozlabs.org; dmarc=pass (p=none dis=none) header.from=outlook.com Authentication-Results: gandalf.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=outlook.com header.i=@outlook.com header.a=rsa-sha256 header.s=selector1 header.b=Lii4kGvQ; dkim-atps=neutral Authentication-Results: gandalf.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org; envelope-from=linux-ext4+bounces-16477-patchwork-incoming=ozlabs.org@vger.kernel.org; receiver=ozlabs.org) Received: from tor.lore.kernel.org (tor.lore.kernel.org [IPv6:2600:3c04:e001:36c::12fc:5321]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by gandalf.ozlabs.org (Postfix) with ESMTPS id 4gF86459qRz4wTX for ; Tue, 12 May 2026 17:55:40 +1000 (AEST) Received: from smtp.subspace.kernel.org (conduit.subspace.kernel.org [100.90.174.1]) by tor.lore.kernel.org (Postfix) with ESMTP id 30545308E603 for ; Tue, 12 May 2026 07:51:39 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id D5DC838C41B; Tue, 12 May 2026 07:51:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=outlook.com header.i=@outlook.com header.b="Lii4kGvQ" X-Original-To: linux-ext4@vger.kernel.org Received: from SY8PR01CU002.outbound.protection.outlook.com (mail-australiaeastazolkn19010021.outbound.protection.outlook.com [52.103.72.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2268633DED5; Tue, 12 May 2026 07:51:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.103.72.21 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778572296; cv=fail; b=RzcLc9gaKMPv2ru7QToQKZH4b8nafztdneX2uyvE5wJwynnWO1yo4GHLF6WRyehxEXKXGZCKwHEG4DvOsWWd1dfyDZEAaEBKhBnW0TlbhEvpI7J7j2CRdIDNUTF0+9/p5oFuFF98F3TEHRuRvoabctgVTv/pIj0OHnhKdwq1rno= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778572296; c=relaxed/simple; bh=XdjZyd4lI6xgXBurWKdSZ4/i7fJv5BOAZrNnwuwAW7A=; h=From:Date:Subject:Content-Type:Message-ID:To:Cc:MIME-Version; b=YvPPrFIFN4DsL+tcBh2vKXqdf/MVfsKnvGuHSfSU7TOl1jmHoTvEWroBeu6RejXMySoDvOWUx6F2+xKhwmv6h/f6fD6XCzKrkeSaPfhbtDzqf/0hj5S+NENkdLgb76PmJ/JVk2641M9UCipCeTSMLjTX4ltcNtdo3P4Bo+euLcw= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=outlook.com; spf=pass smtp.mailfrom=outlook.com; dkim=pass (2048-bit key) header.d=outlook.com header.i=@outlook.com header.b=Lii4kGvQ; arc=fail smtp.client-ip=52.103.72.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=outlook.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=outlook.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=CSmjb8F8EousX/rAp2E/94ifDJFERRheXeOhYc73KeZIr2Z2qf0PhOMIukxUK6fWBKAPs0cW8TmN7LELrAdVBDVvSPmgnLbUjWnjTRXkOzMmDNLnpVIDtY6ClZtCzowedKtduvKn1WoHfctrfk3hRPGkRLWPFc3jH3BSVDf+uDaObzC9vv2LJsi5OSWB3meLtHCUIIVr49vveLlp4ZMLjnsH0I6tzJkqRmo+Seg5heAJ6W8anNd7sJwpGyeu3zZRZTcuRUHpRkUsNQCKU0gPMU3GMbGqtZkQ8CoznsNWjzIB0h/p0VHeVRhacZdOKo2C4IYsSYoUK1mclAQNYOz0og== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=JwsYc3NlMD9ReTFXWxHp9N8jQHnOZ7V+NnjSkmVc978=; b=Gxo5tJYf7pc5PbyHwr09O/upJ5MW7qYkn6osFK2Rrfn3UoJmRy2Wj+R4blPeION01gLyGHoh9XaJhlb2qfnAy6uns9E/Jkw3NmvRfcZ/So3IdGwVnZqrLzbKziZBcrpUx3J1AMwtqvIHChg43/n/9IeU8f3cXqDkmY2VYLh5dD3+5xKFnJVyi256sVxMFfIsK7rPYEN+Noh4vLEktbJgqyhClaXEcaapZf4eEJcjdfHn8a+AQNjtvfOnAIUrpnCFlHTU3v55xj3muPq0SB/0QZX2BqDPNj47D3RsxIWGNmv/S2wpYlf05r44+GqxT5POWPhYpx/JL3pKiGWKhoq//A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JwsYc3NlMD9ReTFXWxHp9N8jQHnOZ7V+NnjSkmVc978=; b=Lii4kGvQEREcZbrKZW+970lZ7JX9BY+MeHtTM/JaTISJRmzBlPwsnYvh3bX/eCrPfGVLX2ncsrxgzdLnmGmcnyDNxt3uopZS2j7rIuSLijuO85PVHxRWxIBuezn7XQ4oGzqMM96A71ukaMMekbq79Qk+wFUlfISpZk6YXarQ+p2aPNSzLtE/8ECpRJMUPCFLxlebvhi9NBXKm+AUvmZr8NTpy8O1bOn2snlxy6epLI+Thn3Ubzk+EFxhI3alGFYtZxAZyuxKEkfgVqDLsT7JRaX6m8w2U4FmQTzcw+BY9Qk6CRNcmjeTlZcemWK9rk4u5sSwbqfpylzMgyY+9HndlA== Received: from SYBPR01MB7881.ausprd01.prod.outlook.com (2603:10c6:10:1b0::5) by ME5PR01MB10331.ausprd01.prod.outlook.com (2603:10c6:220:253::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9891.23; Tue, 12 May 2026 07:51:30 +0000 Received: from SYBPR01MB7881.ausprd01.prod.outlook.com ([fe80::7cd2:d6e8:3fa0:5f0c]) by SYBPR01MB7881.ausprd01.prod.outlook.com ([fe80::7cd2:d6e8:3fa0:5f0c%3]) with mapi id 15.20.9891.021; Tue, 12 May 2026 07:51:30 +0000 From: Junrui Luo Date: Tue, 12 May 2026 15:49:34 +0800 Subject: [PATCH] jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() Message-ID: X-B4-Tracking: v=1; b=H4sIAI3bAmoC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE vPSU3UzU4B8JSMDIzMDU0Mj3bTMitRiXaO0NJM0yzTzFAMzEyWg2oKiVLAEUGl0bG0tAO0/9IR XAAAA X-Change-ID: 20260512-fixes-2ff4f9f7d064 To: Theodore Ts'o , Jan Kara , Harshad Shirwadkar Cc: linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, Yuhao Jiang , stable@vger.kernel.org, Junrui Luo X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=1474; i=moonafterrain@outlook.com; h=from:subject:message-id; bh=XdjZyd4lI6xgXBurWKdSZ4/i7fJv5BOAZrNnwuwAW7A=; b=owJ4nJvAy8zAJVb4wiKgu++DA+NptSSGLKbbvYyzaqWLqxfM9xPsTbdbql3cJle8Nmf2BoHLS Q9yNqsWne4oZWEQ42KQFVNkOV5w6ZuF7xbdLT5bkmHmsDKBDGHg4hSAiZQEMDKcuLDk/NE3D1of CH8PWf04/59V8gXD6Mp6U+9tNQXJVX7sjAwrXvBlPPvhe3bS9oMnStzKhE646Eft5xCV2PL66Q4 r5pvsAD9VSwg= X-Developer-Key: i=moonafterrain@outlook.com; a=openpgp; fpr=C770D2F6384DB42DB44CB46371E838508B8EF040 X-ClientProxiedBy: TY4P301CA0013.JPNP301.PROD.OUTLOOK.COM (2603:1096:405:26f::19) To SYBPR01MB7881.ausprd01.prod.outlook.com (2603:10c6:10:1b0::5) X-Microsoft-Original-Message-ID: <20260512-fixes-v1-1-22146bdb46d2@outlook.com> Precedence: bulk X-Mailing-List: linux-ext4@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SYBPR01MB7881:EE_|ME5PR01MB10331:EE_ X-MS-Office365-Filtering-Correlation-Id: 13274087-0658-4afe-aff9-08deaffb471d X-Microsoft-Antispam: BCL:0;ARA:14566002|5062599005|22091999003|6090799003|24121999003|24021099003|55001999006|23021999003|12121999013|41001999006|15080799012|8060799015|19110799012|5072599009|40105399003|52005399003|3412199025|440099028|12091999003|1710799026; X-Microsoft-Antispam-Message-Info: =?utf-8?q?IRWuv2PNepFUQibPwCBNFoLMl6RMBO4?= =?utf-8?q?xXKAZ394TMRPiBTYzH75SiZf5MG/RZVH3DYzpIKD1nijnVWJo1JKx3cKzcxYL9+ts?= =?utf-8?q?iapNzOaboeJ1VXQHJiON9b9QZFeDtOfzZIL58EhhHPUaqeLpv+r14y529DNn+cEa9?= =?utf-8?q?rs92bi/YqJgAr9sMTqrDE5npJGIk+3MBCFCdOPcVqttFCTLyq+QN6oyDtaSBHoJZe?= =?utf-8?q?/L2/7Gnva4CcRWxZzm2qTBSud2V6jXoEqyQNc5coOLJOmnlZb2j/tnH+evIVI9csn?= =?utf-8?q?//9rMaLTbsmefRMgfGEJa+wRtaDFujKqy6YZnv1Oj0Z+AvPeGe422+2NkT2q5hSqy?= =?utf-8?q?Re3IiiLzJaVobmz4SrqMqdNEkKt7y7UduUFji9hsEZow8YiUvpFlhC0q1JvMq8hsY?= =?utf-8?q?hbmlfh54y2/DTq1MfyUyHdbmPH8h2qXM8w1dVXBPXtZyMRiVPFvU+34CdCapve2Ha?= =?utf-8?q?dz/0/JJiQ/21FiR+j5ZMK5whklSx7gkzbpzoE+/Qotn26K+g7aAVmSHTLiyyvC57k?= =?utf-8?q?xHxuW2VKYCWLHoHBJZVqYQrep0DsM0lgh6jDQ4xvq00BEfqNCEU0kMzar+b54LXCg?= =?utf-8?q?YfrSOoZmA9Qm2cOAxUHHj2xRwLLn2NQ6BNIU2/ZJzFtTK6Uny/qGDFTMo5ltvf6gV?= =?utf-8?q?wH8KNgXsPenq5vzT8AnQ54ZN6G0BkF3pasISrNNb3E7coZfZOkzWUHaoeD05FiJlL?= =?utf-8?q?WS1Vb8Vtts/9GOnrE15olxjYKI6cxJPjLbf8OrHLrMJmVRhmHZcgSh5t0SzNcifYz?= =?utf-8?q?IB8/w6HlRn0+0kfx1wJG+/VTWvAMIzendp3BX76ULGbybMsb8QJSU8ITfpJOTur+r?= =?utf-8?q?sHhQaAav3ygcGwhi1s1FiC/VPWk1VoBnxP0oLjXVnYqZFEZadQmCkVaT333rqa9ue?= =?utf-8?q?5hb4LKXU8dzob89QklyRlK2FVKKanmeNCDoaqSvYNokwL5yvIoJ5LvW40vF3fRRsb?= =?utf-8?q?+10h0D3I4RBcwpGICTzE8UdiSOsn2Gy0IyC26HyBE5/Fyy+X/HY93uYBKQY/El9M2?= =?utf-8?q?Wl6NoX/qqPQEE1lXG6mTomKPQc8tlmngUOo1jnxZ2g8XL5REznddZiVV4uPqDhm2V?= =?utf-8?q?hcAlO6gVqowOqi+TFF7OrP5CZ7pAZCba2wVHssanozXhJ8TtEebQxurBmV7mn92YY?= =?utf-8?q?MaqyA2Z4jxZpCaKYOk7JGVfrErdo5ZtZXna7A=3D=3D?= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?q?9eJA0GxeGU363te9QPd7NM3zku6z?= =?utf-8?q?1sDx8Skb8/C+ocJWk+ux5eZ13H/BeeRJCnD07d2QOp/vemXfX/mmI89mwQyY4OHLn?= =?utf-8?q?21P9X1IqsJGLpasQl7O031j4T24mWrh6thHePxn28G4kLPNuwxSB37i/FgkemkgBV?= =?utf-8?q?rxJ02/EZM7pKeHqZZV+GRqmkCgyyWw8myjzEvnA54vADvgCwr+gEWSjnf7iAXNoWX?= =?utf-8?q?yVWd03l6D1tUafYABTHu4NAetwSEAy4N39xfldGyFh9JoBTGqCNukeS7n+ijRkzt1?= =?utf-8?q?k8YlTtxrwNF+Iz3B5M5P8Qs9ClmFyv8YACwAyH59R5bWUFY5Tt1L6H8dL59EfdNov?= =?utf-8?q?XnSXm6HXLG711YSKqe9xo2m0VzZLC6TO2g5TY4hDlmkelekpqmNyO3S1iFL+wwUk9?= =?utf-8?q?deqPeXasBMZCkEZo9ALGLvi8n6sX8Umq8TbqIRo+P1n/OB2veJ8QX0DW4vPdzayX8?= =?utf-8?q?JfNp2DoOfA4RqdXmmumAmtkgllRncLkPfgveAOQ2qnRR9QzMZINwMu1TM4qsaqy2Y?= =?utf-8?q?iVOGsxD0wxObFLfOgpvleJU0BSLv1kBJjnfVCS/fZVMUguOC4pCq8KFM3X9At3XB8?= =?utf-8?q?lxnsBNydWJ+VaUwLrrEMvUwyI2V1q5d0GM+G8+5h82rWUuSAE80jU9ak/6Fghgw0S?= =?utf-8?q?G2fBuJlCHM9rdBUjlS8WQ9ss8xNjMeAB1I2OlVtmXvdBJj/W9RZJZiBPJRlAH0wpC?= =?utf-8?q?79PdOq0d02hYWCptHi0xXtW1aCx/vSxvFWYTL6ccnS7L2n+vb/E3yN3luinIUqyoW?= =?utf-8?q?BDZEsM2EfmMPPOUt5RE5bqDbxv/9YR3UQlTmt9aFDjXRpUFCDzcGZ2EG9jGBw0Qbr?= =?utf-8?q?uq5Bm65vgt/iKpHWYGL81ARY7U/9RAhUKZMnKl/7nxTIZzjYnx15R8v0YONGv5yHE?= =?utf-8?q?gNKvAGm1gUjdYx2+0gNeyon92LeKgi8r95MhKBYsxoDVSDGtSOkj66P3c76nFlmE7?= =?utf-8?q?9LgVikHwcBqaD8fTm/lU30fxqz0hCh+dUf7ezokD27jyJ7szr1UZtqcmOIi4oxVzv?= =?utf-8?q?Wpz12++Ll7I04FK4HHhJxlUpFFVF0YKIPE4Ho6XDac0l4+hr+sPGr/mC0I3//uWc2?= =?utf-8?q?qzOuDLwEOl+O3z3u+BHaARCb9GB8pU7o3MzDC+zN4tiy7ChTxYMtfMQX8S2cr4+rO?= =?utf-8?q?Js+lDZyO3wY4ETxy6mjGByh4VbmMeMqJSAyuKCKv8WDw+Kl59UdJdCxMNCdRIaVeU?= =?utf-8?q?jAwndLDrVYE/MvR/Q952u5791/SpD60U3yPcL5N9BHiSOvEPRtQuVZw+ndW5DMoxg?= =?utf-8?q?k+m+sTO5sUW2v6kBrrT/71RGkjf6fkh5VynI84A+GerHh81qRUfDSPgopL9dECyrx?= =?utf-8?q?khI/7dPZ28u32YEiB1P5WRO9J1orOq0SjZaeA=3D=3D?= X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 13274087-0658-4afe-aff9-08deaffb471d X-MS-Exchange-CrossTenant-AuthSource: SYBPR01MB7881.ausprd01.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 May 2026 07:51:30.4468 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: ME5PR01MB10331 X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=disabled version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on gandalf.ozlabs.org jbd2_journal_initialize_fast_commit() validates journal capacity by checking (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS). Both j_last and num_fc_blks are unsigned, so when num_fc_blks exceeds j_last the subtraction wraps to a large value, bypassing the bounds check. The resulting underflow corrupts j_last, j_fc_first, and j_free, leading to journal abort. Fix by adding an overflow guard that checks num_fc_blks against j_last before performing the subtraction. Fixes: 6866d7b3f2bb ("ext4 / jbd2: add fast commit initialization") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo --- fs/jbd2/journal.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- base-commit: 7aaa8047eafd0bd628065b15757d9b48c5f9c07d change-id: 20260512-fixes-2ff4f9f7d064 Best regards, diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index cb2c529a8f1b..a54146576c3f 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -2263,7 +2263,8 @@ jbd2_journal_initialize_fast_commit(journal_t *journal) unsigned long long num_fc_blks; num_fc_blks = jbd2_journal_get_num_fc_blks(sb); - if (journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS) + if (num_fc_blks > journal->j_last || + journal->j_last - num_fc_blks < JBD2_MIN_JOURNAL_BLOCKS) return -ENOSPC; /* Are we called twice? */