Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb9b5f01 authored by Theodore Ts'o's avatar Theodore Ts'o
Browse files

ext4: bubble errors from ext4_find_inline_data_nolock() up to ext4_iget() 



If ext4_find_inline_data_nolock() returns an error it needs to get
reflected up to ext4_iget().  In order to fix this,
ext4_iget_extra_inode() needs to return an error (and not return
void).

This is related to "ext4: do not allow external inodes for inline
data" (which fixes CVE-2018-11412) in that in the errors=continue
case, it would be useful to for userspace to receive an error
indicating that file system is corrupted.

Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Reviewed-by: default avatarAndreas Dilger <adilger@dilger.ca>
Cc: stable@kernel.org
parent 117166ef

fs/ext4/inode.c

+7 −3
Original line number Diff line number Diff line
@@ -4701,19 +4701,21 @@ static blkcnt_t ext4_inode_blocks(struct ext4_inode *raw_inode, 
	}

}



static inline void ext4_iget_extra_inode(struct inode *inode,

static inline int ext4_iget_extra_inode(struct inode *inode,

					 struct ext4_inode *raw_inode,

					 struct ext4_inode_info *ei)

{

	__le32 *magic = (void *)raw_inode +

			EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize;



	if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32) <=

	    EXT4_INODE_SIZE(inode->i_sb) &&

	    *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {

		ext4_set_inode_state(inode, EXT4_STATE_XATTR);

		ext4_find_inline_data_nolock(inode);

		return ext4_find_inline_data_nolock(inode);

	} else

		EXT4_I(inode)->i_inline_off = 0;

	return 0;

}



int ext4_get_projid(struct inode *inode, kprojid_t *projid)
@@ -4913,7 +4915,9 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) 
			ei->i_extra_isize = sizeof(struct ext4_inode) -

					    EXT4_GOOD_OLD_INODE_SIZE;

		} else {

			ext4_iget_extra_inode(inode, raw_inode, ei);

			ret = ext4_iget_extra_inode(inode, raw_inode, ei);

			if (ret)

				goto bad_inode;

		}

	}