During fast commit replay, ext4_iget() skips normal extent-tree validation. Replay helpers then call ext4_find_extent() and ext4_ext_insert_extent() on the unchecked inline root. A corrupted root can advertise more entries than fit in EXT4_I(inode)->i_data. In particular, eh_entries == 4 and eh_max == 5 make replay insert a fifth extent past i_data and overwrite adjacent inode fields. Validate extent-formatted inode roots in ext4_find_extent() during fast commit replay, before traversal or insertion can trust the header. Fixes: 8016e29f4362 ("ext4: fast commit recovery path") Assisted-by: Codex:gpt-5 Signed-off-by: Jérémy Jean --- fs/ext4/extents.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 15972410d460..b95eafb0d5ca 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -905,6 +905,13 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block, ret = -EFSCORRUPTED; goto err; } + /* ext4_iget() skips extent validation during fast commit replay. */ + if (unlikely((EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) && + ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) { + ret = ext4_ext_check(inode, eh, depth, 0); + if (ret) + goto err; + } if (path) { ext4_ext_drop_refs(path); -- 2.47.3