Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 205c6fa2 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Revert "ext4: fix use-after-free in ext4_rename_dir_prepare" 



This reverts commit 10801095 which is
commit 0be698ecbe4471fcad80e81ec6a05001421041b3 upstream as it breaks
the build in Android kernel builds due to out-of-tree changes that were
never merged upstream.

Bug: 236690716
Fixes: bc1a5b8c02ae ("Merge 4.14.283 into android-4.14-stable")
Cc: Daniel Rosenberg <drosen@google.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: I511f362fecb21bdc53fb3a93bb9772be96e7f985
parent 08bd9b34

fs/ext4/namei.c

+3 −27
Original line number Diff line number Diff line
@@ -3584,9 +3584,6 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle, 
	struct buffer_head *bh;



	if (!ext4_has_inline_data(inode)) {

		struct ext4_dir_entry_2 *de;

		unsigned int offset;



		/* The first directory block must not be a hole, so

		 * treat it as DIRENT_HTREE

		 */
@@ -3595,30 +3592,9 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle, 
			*retval = PTR_ERR(bh);

			return NULL;

		}



		de = (struct ext4_dir_entry_2 *) bh->b_data;

		if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data,

					 bh->b_size, 0) ||

		    le32_to_cpu(de->inode) != inode->i_ino ||

		    strcmp(".", de->name)) {

			EXT4_ERROR_INODE(inode, "directory missing '.'");

			brelse(bh);

			*retval = -EFSCORRUPTED;

			return NULL;

		}

		offset = ext4_rec_len_from_disk(de->rec_len,

		*parent_de = ext4_next_entry(

					(struct ext4_dir_entry_2 *)bh->b_data,

					inode->i_sb->s_blocksize);

		de = ext4_next_entry(de, inode->i_sb->s_blocksize);

		if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data,

					 bh->b_size, offset) ||

		    le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) {

			EXT4_ERROR_INODE(inode, "directory missing '..'");

			brelse(bh);

			*retval = -EFSCORRUPTED;

			return NULL;

		}

		*parent_de = de;



		return bh;

	}