kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/fs/ext4
History
Ye Bin b374e9ecc9 ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() 
[ Upstream commit 5701875f96 ]

There's issue as follows:
BUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790
Read of size 4 at addr ffff88807b003000 by task syz-executor.0/15172

CPU: 3 PID: 15172 Comm: syz-executor.0
Call Trace:
 __dump_stack lib/dump_stack.c:82 [inline]
 dump_stack+0xbe/0xfd lib/dump_stack.c:123
 print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400
 __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560
 kasan_report+0x3a/0x50 mm/kasan/report.c:585
 ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137
 ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896
 ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323
 evict+0x39f/0x880 fs/inode.c:622
 iput_final fs/inode.c:1746 [inline]
 iput fs/inode.c:1772 [inline]
 iput+0x525/0x6c0 fs/inode.c:1758
 ext4_orphan_cleanup fs/ext4/super.c:3298 [inline]
 ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300
 mount_bdev+0x355/0x410 fs/super.c:1446
 legacy_get_tree+0xfe/0x220 fs/fs_context.c:611
 vfs_get_tree+0x8d/0x2f0 fs/super.c:1576
 do_new_mount fs/namespace.c:2983 [inline]
 path_mount+0x119a/0x1ad0 fs/namespace.c:3316
 do_mount+0xfc/0x110 fs/namespace.c:3329
 __do_sys_mount fs/namespace.c:3540 [inline]
 __se_sys_mount+0x219/0x2e0 fs/namespace.c:3514
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x67/0xd1

Memory state around the buggy address:
 ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

Above issue happens as ext4_xattr_delete_inode() isn't check xattr
is valid if xattr is in inode.
To solve above issue call xattr_check_inode() check if xattr if valid
in inode. In fact, we can directly verify in ext4_iget_extra_inode(),
so that there is no divergent verification.

Fixes: e50e5129f3 ("ext4: xattr-in-inode support")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20250208063141.1539283-3-yebin@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: David Nyström <david.nystrom@est.tech>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-19 13:10:14 +01:00
..
.kunitconfig ext4: add .kunitconfig fragment to enable ext4-specific tests 2021-02-11 23:16:30 -05:00
acl.c ext4: use ext4_journal_start/stop for fast commit transactions 2023-05-11 23:00:16 +09:00
acl.h ext4: apply umask if ACL support is disabled 2023-11-28 16:56:35 +00:00
balloc.c ext4: reorder capability check last 2025-06-04 14:37:56 +02:00
bitmap.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
block_validity.c ext4: make block validity check resistent to sb bh corruption 2025-05-02 07:44:38 +02:00
dir.c ext4: fix OOB read when checking dotdot dir 2025-04-10 14:32:06 +02:00
ext4.h ext4: fix error message when rejecting the default hash 2026-01-19 13:10:13 +01:00
ext4_extents.h ext4: fix sparse warnings 2021-08-30 23:36:50 -04:00
ext4_jbd2.c ext4: use ext4_debug() instead of jbd_debug() 2023-01-12 11:59:04 +01:00
ext4_jbd2.h ext4: Support for checksumming from journal triggers 2021-08-30 23:36:50 -04:00
extents.c ext4: prevent stale extent cache entries caused by concurrent get es_cache 2025-06-27 11:05:30 +01:00
extents_status.c ext4: make ext4_es_insert_extent() return void 2024-08-19 05:45:28 +02:00
extents_status.h ext4: make ext4_es_insert_extent() return void 2024-08-19 05:45:28 +02:00
fast_commit.c ext4: use handle to mark fc as ineligible in __track_dentry_update() 2024-10-17 15:11:38 +02:00
fast_commit.h ext4: add missing validation of fast-commit record lengths 2023-01-12 11:59:05 +01:00
file.c ext4: fix checks for orphan inodes 2025-10-19 16:21:38 +02:00
fsmap.c ext4: correctly handle queries for metadata mappings 2025-10-19 16:21:49 +02:00
fsmap.h ext4: fsmap: fix the block/inode bitmap comment 2021-06-24 09:48:29 -04:00
fsync.c block: use an on-stack bio in blkdev_issue_flush 2021-01-27 09:51:48 -07:00
hash.c ext4: improve error handling from ext4_dirhash() 2023-05-17 11:50:30 +02:00
ialloc.c ext4: clear i_state_flags when alloc inode 2026-01-19 13:09:49 +01:00
indirect.c ext4: fix hole length calculation overflow in non-extent inodes 2025-08-28 16:24:28 +02:00
inline.c ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() 2026-01-19 13:09:20 +01:00
inode-test.c fs: ext4: Modify inode-test.c to use KUnit parameterized testing feature 2020-12-02 16:07:25 -07:00
inode.c ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() 2026-01-19 13:10:14 +01:00
ioctl.c ext4: prevent stale extent cache entries caused by concurrent get es_cache 2025-06-27 11:05:30 +01:00
Kconfig ext: EXT4_KUNIT_TESTS should depend on EXT4_FS instead of selecting it 2021-02-11 23:12:59 -05:00
Makefile ext4: Move orphan inode handling into a separate file 2021-08-30 23:36:51 -04:00
mballoc.c ext4: fix incorrect group number assertion in mb_check_buddy 2026-01-19 13:09:49 +01:00
mballoc.h ext4: fix FS_IOC_GETFSMAP handling 2024-12-14 19:51:12 +01:00
migrate.c ext4: fix i_data_sem unlock order in ext4_ind_migrate() 2024-10-17 15:11:33 +02:00
mmp.c ext4: fix lockdep warning when enabling MMP 2023-05-24 17:36:43 +01:00
move_extent.c ext4: correct the checking of quota files before moving extents 2026-01-19 13:09:26 +01:00
namei.c ext4: fix off-by-one error in do_split 2025-05-02 07:44:02 +02:00
orphan.c ext4: align max orphan file size with e2fsprogs limit 2026-01-19 13:09:49 +01:00
page-io.c ext4: handle redirtying in ext4_bio_write_page() 2024-09-12 11:07:42 +02:00
readpage.c block: Add bio_max_segs 2021-02-26 15:49:51 -07:00
resize.c ext4: fix corruption during on-line resize 2024-04-10 16:18:40 +02:00
super.c ext4: fix error message when rejecting the default hash 2026-01-19 13:10:13 +01:00
symlink.c ext4: report correct st_size for encrypted symlinks 2021-07-25 20:01:06 -07:00
sysfs.c ext4: Fix function prototype mismatch for ext4_feat_ktype 2023-02-25 12:06:45 +01:00
truncate.h ext4: Convert to use mapping->invalidate_lock 2021-07-13 14:29:00 +02:00
verity.c fs: ext4: initialize fsdata in pagecache_write() 2023-01-12 11:59:00 +01:00
xattr.c ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() 2026-01-19 13:10:14 +01:00
xattr.h ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() 2026-01-19 13:10:14 +01:00
xattr_hurd.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_security.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_trusted.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00
xattr_user.c acl: handle idmapped mounts 2021-01-24 14:27:17 +01:00