Re: [PATCH -next] ext4: fix use-after-free in ext4_rename_dir_prepare

From: "Theodore Ts'o" <tytso@mit.edu>
To: Ye Bin <yebin10@huawei.com>
Cc: adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org,
	linux-kernel@vger.kernel.org, jack@suse.cz, lczerner@redhat.com
Subject: Re: [PATCH -next] ext4: fix use-after-free in ext4_rename_dir_prepare
Date: Fri, 13 May 2022 17:53:13 -0400	[thread overview]
Message-ID: <Yn7TSdP3n70WRIgG@mit.edu> (raw)
In-Reply-To: <Yn7KC6k/1Ncp6/Tl@mit.edu>

On Fri, May 13, 2022 at 05:13:47PM -0400, Theodore Ts'o wrote:
> 
> I think we should be calling ext4_error_inode()?  If the directory is
> missing '.' or '..' below, the file system is corrupt, so we probably
> should mark the file system as inconsistent, so that e2fsck can fix
> the file system.

I noticed one other problem; which is that by returning NULL and not
setting retval, ext4_rename_dir_prepare() will end up returning
uninitialized stack garbage as the "error code".

So I'm going to be applying this commit with the following change:

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 50be41dc5831..b202626391ff 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3471,8 +3471,9 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle,
 					 bh->b_size, 0) ||
 		    le32_to_cpu(de->inode) != inode->i_ino ||
 		    strcmp(".", de->name)) {
-			ext4_warning_inode(inode, "directory missing '.'");
+			EXT4_ERROR_INODE(inode, "directory missing '.'");
 			brelse(bh);
+			*retval = -EFSCORRUPTED;
 			return NULL;
 		}
 		offset = ext4_rec_len_from_disk(de->rec_len,
@@ -3481,8 +3482,9 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle,
 		if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data,
 					 bh->b_size, offset) ||
 		    le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) {
-			ext4_warning_inode(inode, "directory missing '..'");
+			EXT4_ERROR_INODE(inode, "directory missing '..'");
 			brelse(bh);
+			*retval = -EFSCORRUPTED;
 			return NULL;
 		}
 		*parent_de = de;
