APPLIED[HWE-5.8]: [SRU B/F/H/I/OEM-5.10/HWE-5.8 1/1] ext4: fix race writing to an inline_data file while its xattrs are changing

[Stefan Bader]

On 15.09.21 19:28, Thadeu Lima de Souza Cascardo wrote:
> From: Theodore Ts'o <tytso at mit.edu>
> 
> The location of the system.data extended attribute can change whenever
> xattr_sem is not taken.  So we need to recalculate the i_inline_off
> field since it mgiht have changed between ext4_write_begin() and
> ext4_write_end().
> 
> This means that caching i_inline_off is probably not helpful, so in
> the long run we should probably get rid of it and shrink the in-memory
> ext4 inode slightly, but let's fix the race the simple way for now.
> 
> Cc: stable at kernel.org
> Fixes: f19d5870cbf72 ("ext4: add normal write support for inline data")
> Reported-by: syzbot+13146364637c7363a7de at syzkaller.appspotmail.com
> Signed-off-by: Theodore Ts'o <tytso at mit.edu>
> (cherry picked from commit a54c4613dac1500b40e4ab55199f7c51f028e848)
> CVE-2021-40490
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
> ---

Applied to focal:linux-hwe-5.8/hwe-5.8. Thanks.

-Stefan

>   fs/ext4/inline.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
> index 6c95196a6f80..952c3e1715d4 100644
> --- a/fs/ext4/inline.c
> +++ b/fs/ext4/inline.c
> @@ -750,6 +750,12 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
>   	ext4_write_lock_xattr(inode, &no_expand);
>   	BUG_ON(!ext4_has_inline_data(inode));
>   
> +	/*
> +	 * ei->i_inline_off may have changed since ext4_write_begin()
> +	 * called ext4_try_to_write_inline_data()
> +	 */
> +	(void) ext4_find_inline_data_nolock(inode);
> +
>   	kaddr = kmap_atomic(page);
>   	ext4_write_inline_data(inode, &iloc, kaddr, pos, len);
>   	kunmap_atomic(kaddr);
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20210923/94eb1853/attachment.sig>