From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 25 Jul 2026 06:02:03 +0000 (+0200)
Subject: 6.12-stable patches
X-Git-Tag: v6.12.98~1
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=0913a17860f5ae07c5e1b177b3d386dae71598c5;p=thirdparty%2Fkernel%2Fstable-queue.git

6.12-stable patches

added patches:
	ext4-fix-fd-leak-in-ext4_ioc_move_ext-cross-sb-validation.patch
	series
---

diff --git a/queue-6.12/ext4-fix-fd-leak-in-ext4_ioc_move_ext-cross-sb-validation.patch b/queue-6.12/ext4-fix-fd-leak-in-ext4_ioc_move_ext-cross-sb-validation.patch
new file mode 100644
index 0000000000..cbc45faa75
--- /dev/null
+++ b/queue-6.12/ext4-fix-fd-leak-in-ext4_ioc_move_ext-cross-sb-validation.patch
@@ -0,0 +1,45 @@
+From stable+bounces-289044-greg=kroah.com@vger.kernel.org Sat Jul 25 04:41:06 2026
+From: Yun Zhou <yun.zhou@windriver.com>
+Date: Sat, 25 Jul 2026 10:40:29 +0800
+Subject: ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation
+To: <gregkh@linuxfoundation.org>
+Cc: <harshit.m.mogalapalli@oracle.com>, <stable@vger.kernel.org>, <patches@lists.linux.dev>
+Message-ID: <20260725024029.1217577-1-yun.zhou@windriver.com>
+
+From: Yun Zhou <yun.zhou@windriver.com>
+
+The backport of upstream commit c143957520c6 ("ext4: validate donor
+file superblock early in EXT4_IOC_MOVE_EXT") uses a bare 'return -EXDEV'
+which is safe upstream because the fd is managed via CLASS(fd) with
+automatic cleanup (commit 8152f8201088 ("fdget(), more trivial
+conversions")).
+
+However, on 6.12.y the ioctl still uses the traditional fdget/fdput
+pattern, so the bare return bypasses fdput(donor) at the mext_out label,
+leaking the file reference.
+
+Fix by setting err and using goto mext_out.
+
+Fixes: 74796e886ca3 ("ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT")
+Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/ioctl.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -1372,8 +1372,10 @@ group_extend_out:
+ 			goto mext_out;
+ 		}
+ 
+-		if (file_inode(filp)->i_sb != file_inode(fd_file(donor))->i_sb)
+-			return -EXDEV;
++		if (file_inode(filp)->i_sb != file_inode(fd_file(donor))->i_sb) {
++			err = -EXDEV;
++			goto mext_out;
++		}
+ 
+ 		err = mnt_want_write_file(filp);
+ 		if (err)
diff --git a/queue-6.12/series b/queue-6.12/series
new file mode 100644
index 0000000000..45ae874d65
--- /dev/null
+++ b/queue-6.12/series
@@ -0,0 +1 @@
+ext4-fix-fd-leak-in-ext4_ioc_move_ext-cross-sb-validation.patch