diff options
| author | Theodore Ts'o <tytso@mit.edu> | 2018-06-16 21:40:48 +0200 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2018-06-16 21:40:48 +0200 |
| commit | 8cdb5240ec5928b20490a2bb34cb87e9a5f40226 (patch) | |
| tree | c8ecb3fb14d781cc8ccf13ef4a1ca2b4b9a78f86 /fs | |
| parent | ext4: clear i_data in ext4_inode_info when removing inline data (diff) | |
| download | linux-8cdb5240ec5928b20490a2bb34cb87e9a5f40226.tar.xz linux-8cdb5240ec5928b20490a2bb34cb87e9a5f40226.zip | |
ext4: never move the system.data xattr out of the inode body
When expanding the extra isize space, we must never move the
system.data xattr out of the inode body. For performance reasons, it
doesn't make any sense, and the inline data implementation assumes
that system.data xattr is never in the external xattr block.
This addresses CVE-2018-10880
https://bugzilla.kernel.org/show_bug.cgi?id=200005
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ext4/xattr.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 0263692979ec..72377b77fbd7 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -2657,6 +2657,11 @@ static int ext4_xattr_make_inode_space(handle_t *handle, struct inode *inode, last = IFIRST(header); /* Find the entry best suited to be pushed into EA block */ for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) { + /* never move system.data out of the inode */ + if ((last->e_name_len == 4) && + (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) && + !memcmp(last->e_name, "data", 4)) + continue; total_size = EXT4_XATTR_LEN(last->e_name_len); if (!last->e_value_inum) total_size += EXT4_XATTR_SIZE( |