ocfs2: validate suballoc slot and bit of extent and refcount blocks

ocfs2_validate_extent_block() and ocfs2_validate_refcount_block() do not
validate h_suballoc_slot, h_suballoc_bit, rf_suballoc_slot and
rf_suballoc_bit at all.  Since extent blocks and refcount blocks are
allocated from a per-slot suballocator at runtime, their suballoc slots
must be within range and their suballoc bits must fit in a block group
bitmap.

Otherwise a corrupted image can carry an out-of-range slot.  When the
extent block is freed, ocfs2_cache_extent_block_free() caches it and
ocfs2_free_cached_blocks() later passes the unvalidated slot to
ocfs2_get_system_file_inode(); when the refcount block is freed,
ocfs2_remove_refcount_extent() passes it via ocfs2_cache_block_dealloc(). 
get_local_system_inode() will then either hit BUG_ON(slot ==
OCFS2_INVALID_SLOT) or compute an out-of-bounds index into the
local_system_inodes array.  Similarly an oversized suballoc bit will error
out the filesystem in _ocfs2_free_suballoc_bits().

Furthermore group descriptor validation only guarantees bg_bits within the
physical bitmap size, so a corrupted image can still carry a suballoc bit
beyond bg_bits, which would let ocfs2_block_group_clear_bits() clear bits
beyond bg_bitmap.  Convert the remaining BUG_ON against group->bg_bits in
_ocfs2_free_suballoc_bits() to ocfs2_error() as well.

Reject out-of-range suballoc slots and oversized suballoc bits during
validation.

Link: https://lore.kernel.org/20260901125221.1634686-5-joseph.qi@linux.alibaba.com
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>

0 files changed, 0 insertions, 0 deletions