From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:54554 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726816AbeI3WBa (ORCPT ); Sun, 30 Sep 2018 18:01:30 -0400 Date: Sun, 30 Sep 2018 08:28:01 -0700 From: Greg KH To: Zubin Mithra Cc: stable@vger.kernel.org, tytso@mit.edu, natechancellor@gmail.com, groeck@chromium.org Subject: Re: [PATCH v4.4.y] ext4: never move the system.data xattr out of the inode body Message-ID: <20180930152801.GA2942@kroah.com> References: <20180928162144.216318-1-zsm@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180928162144.216318-1-zsm@chromium.org> Sender: stable-owner@vger.kernel.org List-ID: On Fri, Sep 28, 2018 at 09:21:44AM -0700, Zubin Mithra wrote: > From: Theodore Ts'o > > commit 8cdb5240ec5928b20490a2bb34cb87e9a5f40226 upstream. > > When expanding the extra isize space, we must never move the > system.data xattr out of the inode body. For performance reasons, it > doesn't make any sense, and the inline data implementation assumes > that system.data xattr is never in the external xattr block. > > This addresses CVE-2018-10880 > > https://bugzilla.kernel.org/show_bug.cgi?id=200005 > > Backport Note: > - dfa2064b22("ext4: factor out loop for freeing inode xattr space") > factored out the loop from inside ext4_expand_extra_isize_ea to a > separate function named ext4_xattr_make_inode_space. As the above commit > is not present in 4.4.y, make the change inside ext4_expand_extra_isize_ea. What about a 4.9.y version of this? I can't just take a 4.4 version because someone would suffer a regression if they moved from 4.4.y to 4.9.y :( thanks, greg k-h