Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8cdb5240 authored by Theodore Ts'o's avatar Theodore Ts'o
Browse files

ext4: never move the system.data xattr out of the inode body 

When expanding the extra isize space, we must never move the
system.data xattr out of the inode body.  For performance reasons, it
doesn't make any sense, and the inline data implementation assumes
that system.data xattr is never in the external xattr block.

This addresses CVE-2018-10880

https://bugzilla.kernel.org/show_bug.cgi?id=200005



Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
parent 6e8ab72a

fs/ext4/xattr.c

+5 −0
Original line number Diff line number Diff line
@@ -2657,6 +2657,11 @@ static int ext4_xattr_make_inode_space(handle_t *handle, struct inode *inode, 
		last = IFIRST(header);

		/* Find the entry best suited to be pushed into EA block */

		for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) {

			/* never move system.data out of the inode */

			if ((last->e_name_len == 4) &&

			    (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) &&

			    !memcmp(last->e_name, "data", 4))

				continue;

			total_size = EXT4_XATTR_LEN(last->e_name_len);

			if (!last->e_value_inum)

				total_size += EXT4_XATTR_SIZE(