Return-Path: Received: from mail-pl1-f196.google.com ([209.85.214.196]:39765 "EHLO mail-pl1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727504AbeJEAsR (ORCPT ); Thu, 4 Oct 2018 20:48:17 -0400 Received: by mail-pl1-f196.google.com with SMTP id w14-v6so5543722plp.6 for ; Thu, 04 Oct 2018 10:53:57 -0700 (PDT) From: Greg Hackmann To: stable@vger.kernel.org Cc: Theodore Ts'o , Ben Hutchings , Greg Hackmann Subject: [PATCH 3.18.y 07/10] ext4: never move the system.data xattr out of the inode body Date: Thu, 4 Oct 2018 10:53:17 -0700 Message-Id: <20181004175320.181881-8-ghackmann@google.com> In-Reply-To: <20181004175320.181881-1-ghackmann@google.com> References: <20181004175320.181881-1-ghackmann@google.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: From: Theodore Ts'o commit 8cdb5240ec5928b20490a2bb34cb87e9a5f40226 upstream. When expanding the extra isize space, we must never move the system.data xattr out of the inode body. For performance reasons, it doesn't make any sense, and the inline data implementation assumes that system.data xattr is never in the external xattr block. This addresses CVE-2018-10880 https://bugzilla.kernel.org/show_bug.cgi?id=200005 Signed-off-by: Theodore Ts'o [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings Signed-off-by: Greg Hackmann --- fs/ext4/xattr.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index bb4faf2d0c5c..5f67ef828ccd 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1391,6 +1391,11 @@ retry: /* Find the entry best suited to be pushed into EA block */ entry = NULL; for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) { + /* never move system.data out of the inode */ + if ((last->e_name_len == 4) && + (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) && + !memcmp(last->e_name, "data", 4)) + continue; total_size = EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) + EXT4_XATTR_LEN(last->e_name_len); -- 2.19.0.605.g01d371f741-goog