Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2a18c9c7 authored by Barret Rhoden's avatar Barret Rhoden Committed by Greg Kroah-Hartman
Browse files

ext4: fix use-after-free race with debug_want_extra_isize 



commit 7bc04c5c2cc467c5b40f2b03ba08da174a0d5fa7 upstream.

When remounting with debug_want_extra_isize, we were not performing the
same checks that we do during a normal mount.  That allowed us to set a
value for s_want_extra_isize that reached outside the s_inode_size.

Fixes: e2b911c5 ("ext4: clean up feature test macros with predicate functions")
Reported-by: default avatar <syzbot+f584efa0ac7213c226b7@syzkaller.appspotmail.com>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarBarret Rhoden <brho@google.com>
Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b12a8d80

fs/ext4/super.c

+34 −24
Original line number Diff line number Diff line
@@ -3514,6 +3514,37 @@ int ext4_calculate_overhead(struct super_block *sb) 
	return 0;

}



static void ext4_clamp_want_extra_isize(struct super_block *sb)

{

	struct ext4_sb_info *sbi = EXT4_SB(sb);

	struct ext4_super_block *es = sbi->s_es;



	/* determine the minimum size of new large inodes, if present */

	if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE &&

	    sbi->s_want_extra_isize == 0) {

		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -

						     EXT4_GOOD_OLD_INODE_SIZE;

		if (ext4_has_feature_extra_isize(sb)) {

			if (sbi->s_want_extra_isize <

			    le16_to_cpu(es->s_want_extra_isize))

				sbi->s_want_extra_isize =

					le16_to_cpu(es->s_want_extra_isize);

			if (sbi->s_want_extra_isize <

			    le16_to_cpu(es->s_min_extra_isize))

				sbi->s_want_extra_isize =

					le16_to_cpu(es->s_min_extra_isize);

		}

	}

	/* Check if enough inode space is available */

	if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >

							sbi->s_inode_size) {

		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -

						       EXT4_GOOD_OLD_INODE_SIZE;

		ext4_msg(sb, KERN_INFO,

			 "required extra inode space not available");

	}

}



static void ext4_set_resv_clusters(struct super_block *sb)

{

	ext4_fsblk_t resv_clusters;
@@ -4388,30 +4419,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) 
	} else if (ret)

		goto failed_mount4a;



	/* determine the minimum size of new large inodes, if present */

	if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE &&

	    sbi->s_want_extra_isize == 0) {

		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -

						     EXT4_GOOD_OLD_INODE_SIZE;

		if (ext4_has_feature_extra_isize(sb)) {

			if (sbi->s_want_extra_isize <

			    le16_to_cpu(es->s_want_extra_isize))

				sbi->s_want_extra_isize =

					le16_to_cpu(es->s_want_extra_isize);

			if (sbi->s_want_extra_isize <

			    le16_to_cpu(es->s_min_extra_isize))

				sbi->s_want_extra_isize =

					le16_to_cpu(es->s_min_extra_isize);

		}

	}

	/* Check if enough inode space is available */

	if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize >

							sbi->s_inode_size) {

		sbi->s_want_extra_isize = sizeof(struct ext4_inode) -

						       EXT4_GOOD_OLD_INODE_SIZE;

		ext4_msg(sb, KERN_INFO, "required extra inode space not"

			 "available");

	}

	ext4_clamp_want_extra_isize(sb);



	ext4_set_resv_clusters(sb);
@@ -5197,6 +5205,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) 
		goto restore_opts;

	}



	ext4_clamp_want_extra_isize(sb);



	if ((old_opts.s_mount_opt & EXT4_MOUNT_JOURNAL_CHECKSUM) ^

	    test_opt(sb, JOURNAL_CHECKSUM)) {

		ext4_msg(sb, KERN_ERR, "changing journal_checksum "