DF-3063 / fix.diff
--- sys/vfs/ext2fs/ext2_alloc.c +++ sys/vfs/ext2fs/ext2_alloc.c @@ -1247,9 +1247,11 @@ if (le16toh(fs->e2fs_gd[cg].ext4bgd_flags) & EXT2_BG_INODE_ZEROED) return (0); - all_blks = le16toh(fs->e2fs->e2fs_inode_size) * fs->e2fs_ipg / - fs->e2fs_bsize; - + /* DF-3063: use the validated in-memory inode size (e2fs_isize), + * never the raw on-disk field: at REV0 s_inode_size is + * unvalidated and inflated values drove getblk/bawrite zero- + * fills far past the inode table. */ + all_blks = fs->e2fs_isize * fs->e2fs_ipg / fs->e2fs_bsize; used_blks = howmany(fs->e2fs_ipg - e2fs_gd_get_i_unused(&fs->e2fs_gd[cg]), |