+++ /dev/null
-From 18db4b4e6fc31eda838dd1c1296d67dbcb3dc957 Mon Sep 17 00:00:00 2001
-From: Theodore Ts'o <tytso@mit.edu>
-Date: Thu, 29 Mar 2018 22:10:35 -0400
-Subject: ext4: don't allow r/w mounts if metadata blocks overlap the superblock
-
-From: Theodore Ts'o <tytso@mit.edu>
-
-commit 18db4b4e6fc31eda838dd1c1296d67dbcb3dc957 upstream.
-
-If some metadata block, such as an allocation bitmap, overlaps the
-superblock, it's very likely that if the file system is mounted
-read/write, the results will not be pretty. So disallow r/w mounts
-for file systems corrupted in this particular way.
-
-Signed-off-by: Theodore Ts'o <tytso@mit.edu>
-Cc: stable@vger.kernel.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- fs/ext4/super.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -2260,6 +2260,8 @@ static int ext4_check_descriptors(struct
- ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
- "Block bitmap for group %u overlaps "
- "superblock", i);
-+ if (!sb_rdonly(sb))
-+ return 0;
- }
- if (block_bitmap < first_block || block_bitmap > last_block) {
- ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
-@@ -2272,6 +2274,8 @@ static int ext4_check_descriptors(struct
- ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
- "Inode bitmap for group %u overlaps "
- "superblock", i);
-+ if (!sb_rdonly(sb))
-+ return 0;
- }
- if (inode_bitmap < first_block || inode_bitmap > last_block) {
- ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
-@@ -2284,6 +2288,8 @@ static int ext4_check_descriptors(struct
- ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
- "Inode table for group %u overlaps "
- "superblock", i);
-+ if (!sb_rdonly(sb))
-+ return 0;
- }
- if (inode_table < first_block ||
- inode_table + sbi->s_itb_per_group - 1 > last_block) {
+++ /dev/null
-From e40ff213898502d299351cc2fe1e350cd186f0d3 Mon Sep 17 00:00:00 2001
-From: Theodore Ts'o <tytso@mit.edu>
-Date: Sun, 1 Apr 2018 23:21:03 -0400
-Subject: ext4: force revalidation of directory pointer after seekdir(2)
-
-From: Theodore Ts'o <tytso@mit.edu>
-
-commit e40ff213898502d299351cc2fe1e350cd186f0d3 upstream.
-
-A malicious user could force the directory pointer to be in an invalid
-spot by using seekdir(2). Use the mechanism we already have to notice
-if the directory has changed since the last time we called
-ext4_readdir() to force a revalidation of the pointer.
-
-Reported-by: syzbot+1236ce66f79263e8a862@syzkaller.appspotmail.com
-Signed-off-by: Theodore Ts'o <tytso@mit.edu>
-Cc: stable@vger.kernel.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- fs/ext4/dir.c | 8 +++++---
- 1 file changed, 5 insertions(+), 3 deletions(-)
-
---- a/fs/ext4/dir.c
-+++ b/fs/ext4/dir.c
-@@ -363,13 +363,15 @@ static loff_t ext4_dir_llseek(struct fil
- {
- struct inode *inode = file->f_mapping->host;
- int dx_dir = is_dx_dir(inode);
-- loff_t htree_max = ext4_get_htree_eof(file);
-+ loff_t ret, htree_max = ext4_get_htree_eof(file);
-
- if (likely(dx_dir))
-- return generic_file_llseek_size(file, offset, whence,
-+ ret = generic_file_llseek_size(file, offset, whence,
- htree_max, htree_max);
- else
-- return ext4_llseek(file, offset, whence);
-+ ret = ext4_llseek(file, offset, whence);
-+ file->f_version = inode_peek_iversion(inode) - 1;
-+ return ret;
- }
-
- /*