Syzkaller reported a use-after-free in ext4_find_extent() when using bigalloc. The crash occurs during the extent tree traversal when the system tries to access a freed extent path. The root cause is related to how the multi-block allocator (mballoc) handles alignment in bigalloc filesystems (s_cluster_ratio > 1). When a request for a block is made, mballoc might return a goal start block that is not aligned to the cluster boundary (e.g., block 1 instead of 0) because the cluster start is busy. Previously, ext4_mb_new_inode_pa() and ext4_mb_new_group_pa() did not strictly enforce cluster alignment or handle collisions where aligning down would overlap with busy space. This resulted in the creation of Preallocation (PA) extents that started in the middle of a cluster. This misalignment causes metadata inconsistency between the physical allocation (bitmap) and the logical extent tree, eventually leading to a use-after-free during inode eviction or truncation. This patch fixes the issue by enforcing strict cluster alignment for both inode and group preallocations. Using AC_STATUS_BREAK ensures that we do not manually free the PA (avoiding double-free bugs in the caller's cleanup path) and allows the allocator to find a more suitable block group. Tested with kvm-xfstests -c bigalloc_4k -g quick, no regressions found. Reported-by: syzbot+ee60e584b5c6bb229126@syzkaller.appspotmail.com Fixes: https://syzkaller.appspot.com/bug?extid=ee60e584b5c6bb229126 Co-developed-by: Albin Babu Varghese Signed-off-by: Albin Babu Varghese Signed-off-by: Ahmet Eray Karadag --- fs/ext4/mballoc.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 9087183602e4..549d6cf58f3c 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -5291,6 +5291,21 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) ex.fe_logical = ac->ac_o_ex.fe_logical; adjust_bex: + if (sbi->s_cluster_ratio > 1) { + loff_t mask = ~(sbi->s_cluster_ratio - 1); + loff_t aligned_start = ex.fe_logical & mask; + + if (aligned_start < ac->ac_g_ex.fe_logical) { + ac->ac_status = AC_STATUS_BREAK; + return; + } + + ex.fe_len += (ex.fe_logical - aligned_start); + ex.fe_logical = aligned_start; + + if (ex.fe_logical + ex.fe_len > orig_goal_end) + ex.fe_len = orig_goal_end - ex.fe_logical; + } ac->ac_b_ex.fe_logical = ex.fe_logical; BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical); @@ -5336,6 +5351,7 @@ static noinline_for_stack void ext4_mb_new_group_pa(struct ext4_allocation_context *ac) { struct super_block *sb = ac->ac_sb; + struct ext4_sb_info *sbi = EXT4_SB(sb); struct ext4_locality_group *lg; struct ext4_prealloc_space *pa; struct ext4_group_info *grp; @@ -5347,7 +5363,15 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac) BUG_ON(ac->ac_pa == NULL); pa = ac->ac_pa; + if (sbi->s_cluster_ratio > 1) { + loff_t mask = ~(sbi->s_cluster_ratio - 1); + loff_t pstart = ext4_grp_offs_to_block(sb, &ac->ac_b_ex); + if ((pstart & mask) < pstart) { + ac->ac_status = AC_STATUS_BREAK; + return; + } + } pa->pa_pstart = ext4_grp_offs_to_block(sb, &ac->ac_b_ex); pa->pa_lstart = pa->pa_pstart; pa->pa_len = ac->ac_b_ex.fe_len; -- 2.43.0