Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2142dfa1 authored by Baokun Li's avatar Baokun Li Committed by Greg Kroah-Hartman
Browse files

ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode 



commit 63b1e9bccb71fe7d7e3ddc9877dbdc85e5d2d023 upstream.

There are many places that will get unhappy (and crash) when ext4_iget()
returns a bad inode. However, if iget the boot loader inode, allows a bad
inode to be returned, because the inode may not be initialized. This
mechanism can be used to bypass some checks and cause panic. To solve this
problem, we add a special iget flag EXT4_IGET_BAD. Only with this flag
we'd be returning bad inode from ext4_iget(), otherwise we always return
the error code if the inode is bad inode.(suggested by Jan Kara)

Signed-off-by: default avatarBaokun Li <libaokun1@huawei.com>
Reviewed-by: default avatarJason Yan <yanaijie@huawei.com>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20221026042310.3839669-4-libaokun1@huawei.com


Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4690a4bd

fs/ext4/ext4.h

+2 −1
Original line number Diff line number Diff line
@@ -2608,7 +2608,8 @@ int do_journal_get_write_access(handle_t *handle, 
typedef enum {

	EXT4_IGET_NORMAL =	0,

	EXT4_IGET_SPECIAL =	0x0001, /* OK to iget a system inode */

	EXT4_IGET_HANDLE = 	0x0002	/* Inode # is from a handle */

	EXT4_IGET_HANDLE = 	0x0002,	/* Inode # is from a handle */

	EXT4_IGET_BAD =		0x0004  /* Allow to iget a bad inode */

} ext4_iget_flags;



extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,

fs/ext4/inode.c

+7 −1
Original line number Diff line number Diff line
@@ -5192,8 +5192,14 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, 
	if (IS_CASEFOLDED(inode) && !ext4_has_feature_casefold(inode->i_sb))

		ext4_error_inode(inode, function, line, 0,

				 "casefold flag without casefold feature");

	brelse(iloc.bh);

	if (is_bad_inode(inode) && !(flags & EXT4_IGET_BAD)) {

		ext4_error_inode(inode, function, line, 0,

				 "bad inode without EXT4_IGET_BAD flag");

		ret = -EUCLEAN;

		goto bad_inode;

	}



	brelse(iloc.bh);

	unlock_new_inode(inode);

	return inode;

fs/ext4/ioctl.c

+2 −1
Original line number Diff line number Diff line
@@ -121,7 +121,8 @@ static long swap_inode_boot_loader(struct super_block *sb, 
	blkcnt_t blocks;

	unsigned short bytes;



	inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO, EXT4_IGET_SPECIAL);

	inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO,

			EXT4_IGET_SPECIAL | EXT4_IGET_BAD);

	if (IS_ERR(inode_bl))

		return PTR_ERR(inode_bl);

	ei_bl = EXT4_I(inode_bl);