On Thu, 31 Mar 2022 13:05:15 -0700, Tadeusz Struk wrote:
Syzbot found an issue [1] in ext4_fallocate(). The C reproducer [2] calls fallocate(), passing size 0xffeffeff000ul, and offset 0x1000000ul, which, when added together exceed the bitmap_maxbytes for the inode. This triggers a BUG in ext4_ind_remove_space(). According to the comments in this function the 'end' parameter needs to be one block after the last block to be removed. In the case when the BUG is triggered it points to the last block. Modify the ext4_punch_hole() function and add constraint that caps the length to satisfy the one before laster block requirement.
[...]
Applied, thanks!
[1/1] ext4: limit length to bitmap_maxbytes - blocksize in punch_hole commit: dfc99c5e84e46c610a7bf81dc4a3a126253be459
Best regards,