NACK: [SRU B/F/H/I/OEM-5.10/HWE-5.8 1/1] ext4: fix race writing to an inline_data file while its xattrs are changing

[Kelsey Skunberg]

Sigh. wasn't paying attention closely enough and sent the wrong saved patch.

ignore this please :)

On 2021-09-20 13:41:09 , Kelsey Skunberg wrote:
> From: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
> 
> From: Theodore Ts'o <tytso at mit.edu>
> 
> The location of the system.data extended attribute can change whenever
> xattr_sem is not taken.  So we need to recalculate the i_inline_off
> field since it mgiht have changed between ext4_write_begin() and
> ext4_write_end().
> 
> This means that caching i_inline_off is probably not helpful, so in
> the long run we should probably get rid of it and shrink the in-memory
> ext4 inode slightly, but let's fix the race the simple way for now.
> 
> Cc: stable at kernel.org
> Fixes: f19d5870cbf72 ("ext4: add normal write support for inline data")
> Reported-by: syzbot+13146364637c7363a7de at syzkaller.appspotmail.com
> Signed-off-by: Theodore Ts'o <tytso at mit.edu>
> (cherry picked from commit a54c4613dac1500b40e4ab55199f7c51f028e848)
> CVE-2021-40490
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
> ---
>  fs/ext4/inline.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
> index 6c95196a6f80..952c3e1715d4 100644
> --- a/fs/ext4/inline.c
> +++ b/fs/ext4/inline.c
> @@ -750,6 +750,12 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
>  	ext4_write_lock_xattr(inode, &no_expand);
>  	BUG_ON(!ext4_has_inline_data(inode));
>  
> +	/*
> +	 * ei->i_inline_off may have changed since ext4_write_begin()
> +	 * called ext4_try_to_write_inline_data()
> +	 */
> +	(void) ext4_find_inline_data_nolock(inode);
> +
>  	kaddr = kmap_atomic(page);
>  	ext4_write_inline_data(inode, &iloc, kaddr, pos, len);
>  	kunmap_atomic(kaddr);
> -- 
> 2.30.2
> 
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team