From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pg1-f193.google.com ([209.85.215.193]:42183 "EHLO mail-pg1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728393AbeI3Xvw (ORCPT ); Sun, 30 Sep 2018 19:51:52 -0400 Received: by mail-pg1-f193.google.com with SMTP id i4-v6so7179584pgq.9 for ; Sun, 30 Sep 2018 10:18:00 -0700 (PDT) From: Guenter Roeck To: Greg Kroah-Hartman Cc: Zubin Mithra , stable@vger.kernel.org, Theodore Ts'o , stable@kernel.org, Guenter Roeck Subject: [PATCH v4.9.y] ext4: never move the system.data xattr out of the inode body Date: Sun, 30 Sep 2018 10:17:48 -0700 Message-Id: <1538327868-27369-1-git-send-email-linux@roeck-us.net> Sender: stable-owner@vger.kernel.org List-ID: From: Theodore Ts'o commit 8cdb5240ec5928b20490a2bb34cb87e9a5f40226 upstream. When expanding the extra isize space, we must never move the system.data xattr out of the inode body. For performance reasons, it doesn't make any sense, and the inline data implementation assumes that system.data xattr is never in the external xattr block. This addresses CVE-2018-10880 https://bugzilla.kernel.org/show_bug.cgi?id=200005 Signed-off-by: Theodore Ts'o Cc: stable@kernel.org [groeck: Context changes] Signed-off-by: Guenter Roeck --- I thought the 4.4.y backport should apply, but I think it doesn't after all. This backport applies to v4.9.y. fs/ext4/xattr.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index fdcbe0f2814f..c19c96840480 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1426,6 +1426,11 @@ static int ext4_xattr_make_inode_space(handle_t *handle, struct inode *inode, last = IFIRST(header); /* Find the entry best suited to be pushed into EA block */ for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) { + /* never move system.data out of the inode */ + if ((last->e_name_len == 4) && + (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) && + !memcmp(last->e_name, "data", 4)) + continue; total_size = EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) + EXT4_XATTR_LEN(last->e_name_len); -- 2.7.4