]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ext4: do not allow external inodes for inline data
authorTheodore Ts'o <tytso@mit.edu>
Tue, 22 May 2018 20:15:24 +0000 (16:15 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 25 Jun 2018 23:53:56 +0000 (07:53 +0800)
commitebff7cb0666c47a7ee37dfc815fc85fcaf19be3e
treee29aa6fb15a42b5ddd44c174f5152797d32751e3
parentb097f5b27036860780a8f2416c4f22f786086178
ext4: do not allow external inodes for inline data

commit 117166efb1ee8f13c38f9e96b258f16d4923f888 upstream.

The inline data feature was implemented before we added support for
external inodes for xattrs.  It makes no sense to support that
combination, but the problem is that there are a number of extended
attribute checks that are skipped if e_value_inum is non-zero.

Unfortunately, the inline data code is completely e_value_inum
unaware, and attempts to interpret the xattr fields as if it were an
inline xattr --- at which point, Hilarty Ensues.

This addresses CVE-2018-11412.

https://bugzilla.kernel.org/show_bug.cgi?id=199803

Reported-by: Jann Horn <jannh@google.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Fixes: e50e5129f384 ("ext4: xattr-in-inode support")
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/ext4/inline.c