All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, stable@kernel.org,
	syzbot+13146364637c7363a7de@syzkaller.appspotmail.com,
	Theodore Tso <tytso@mit.edu>
Subject: [PATCH 5.10 01/29] ext4: fix race writing to an inline_data file while its xattrs are changing
Date: Mon,  6 Sep 2021 14:55:16 +0200	[thread overview]
Message-ID: <20210906125449.802815791@linuxfoundation.org> (raw)
In-Reply-To: <20210906125449.756437409@linuxfoundation.org>

From: Theodore Ts'o <tytso@mit.edu>

commit a54c4613dac1500b40e4ab55199f7c51f028e848 upstream.

The location of the system.data extended attribute can change whenever
xattr_sem is not taken.  So we need to recalculate the i_inline_off
field since it mgiht have changed between ext4_write_begin() and
ext4_write_end().

This means that caching i_inline_off is probably not helpful, so in
the long run we should probably get rid of it and shrink the in-memory
ext4 inode slightly, but let's fix the race the simple way for now.

Cc: stable@kernel.org
Fixes: f19d5870cbf72 ("ext4: add normal write support for inline data")
Reported-by: syzbot+13146364637c7363a7de@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/inline.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -750,6 +750,12 @@ int ext4_write_inline_data_end(struct in
 	ext4_write_lock_xattr(inode, &no_expand);
 	BUG_ON(!ext4_has_inline_data(inode));
 
+	/*
+	 * ei->i_inline_off may have changed since ext4_write_begin()
+	 * called ext4_try_to_write_inline_data()
+	 */
+	(void) ext4_find_inline_data_nolock(inode);
+
 	kaddr = kmap_atomic(page);
 	ext4_write_inline_data(inode, &iloc, kaddr, pos, len);
 	kunmap_atomic(kaddr);



  reply	other threads:[~2021-09-06 12:56 UTC|newest]

Thread overview: 39+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-06 12:55 [PATCH 5.10 00/29] 5.10.63-rc1 review Greg Kroah-Hartman
2021-09-06 12:55 ` Greg Kroah-Hartman [this message]
2021-09-06 12:55 ` [PATCH 5.10 02/29] fscrypt: add fscrypt_symlink_getattr() for computing st_size Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 03/29] ext4: report correct st_size for encrypted symlinks Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 04/29] f2fs: " Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 05/29] ubifs: " Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 06/29] Revert "ucounts: Increase ucounts reference counter before the security hook" Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 07/29] Revert "cred: add missing return error code when set_cred_ucounts() failed" Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 08/29] Revert "Add a reference to ucounts for each cred" Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 09/29] static_call: Fix unused variable warn w/o MODULE Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 10/29] xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 11/29] ARM: OMAP1: ams-delta: remove unused function ams_delta_camera_power Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 12/29] gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 13/29] reset: reset-zynqmp: Fixed the argument data type Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 14/29] qed: Fix the VF msix vectors flow Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 15/29] net: macb: Add a NULL check on desc_ptp Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 16/29] qede: Fix memset corruption Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 17/29] perf/x86/intel/pt: Fix mask of num_address_ranges Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 18/29] ceph: fix possible null-pointer dereference in ceph_mdsmap_decode() Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 19/29] perf/x86/amd/ibs: Work around erratum #1197 Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 20/29] perf/x86/amd/power: Assign pmu.module Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 21/29] cryptoloop: add a deprecation warning Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 22/29] ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 23/29] ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17 Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 24/29] ALSA: pcm: fix divide error in snd_pcm_lib_ioctl Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 25/29] serial: 8250: 8250_omap: Fix possible array out of bounds access Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 26/29] spi: Switch to signed types for *_native_cs SPI controller fields Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 27/29] new helper: inode_wrong_type() Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 28/29] fuse: fix illegal access to inode with reused nodeid Greg Kroah-Hartman
2021-09-06 12:55 ` [PATCH 5.10 29/29] media: stkwebcam: fix memory leak in stk_camera_probe Greg Kroah-Hartman
2021-09-06 19:58 ` [PATCH 5.10 00/29] 5.10.63-rc1 review Pavel Machek
2021-09-06 19:58 ` Fox Chen
2021-09-07  7:10 ` Naresh Kamboju
2021-09-07  7:11 ` Samuel Zou
2021-09-07 13:12 ` Sudip Mukherjee
2021-09-07 15:53 ` Jon Hunter
2021-09-07 18:34 ` Florian Fainelli
2021-09-07 20:07 ` Shuah Khan
2021-09-08  1:19 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210906125449.802815791@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+13146364637c7363a7de@syzkaller.appspotmail.com \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.