[PATCH 6.12.y] ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation

[PATCH 6.12.y] ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation

[Yun Zhou]

The backport of upstream commit c143957520c6 ("ext4: validate donor
file superblock early in EXT4_IOC_MOVE_EXT") uses a bare 'return -EXDEV'
which is safe upstream because the fd is managed via CLASS(fd) with
automatic cleanup (commit 8152f8201088 ("fdget(), more trivial
conversions")).

However, on 6.12.y the ioctl still uses the traditional fdget/fdput
pattern, so the bare return bypasses fdput(donor) at the mext_out label,
leaking the file reference.

Fix by setting err and using goto mext_out.

Fixes: 74796e886ca3 ("ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT")
Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
---
 fs/ext4/ioctl.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index a8a024bb62b4..e726f9dbc146 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -1372,8 +1372,10 @@ static long __ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 			goto mext_out;
 		}
 
-		if (file_inode(filp)->i_sb != file_inode(fd_file(donor))->i_sb)
-			return -EXDEV;
+		if (file_inode(filp)->i_sb != file_inode(fd_file(donor))->i_sb) {
+			err = -EXDEV;
+			goto mext_out;
+		}
 
 		err = mnt_want_write_file(filp);
 		if (err)
-- 
2.43.0

Patch "ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation" has been added to the 6.12-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ext4-fix-fd-leak-in-ext4_ioc_move_ext-cross-sb-validation.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


From stable+bounces-289044-greg=kroah.com@vger.kernel.org Sat Jul 25 04:41:06 2026
From: Yun Zhou <yun.zhou@windriver.com>
Date: Sat, 25 Jul 2026 10:40:29 +0800
Subject: ext4: fix fd leak in EXT4_IOC_MOVE_EXT cross-sb validation
To: <gregkh@linuxfoundation.org>
Cc: <harshit.m.mogalapalli@oracle.com>, <stable@vger.kernel.org>, <patches@lists.linux.dev>
Message-ID: <20260725024029.1217577-1-yun.zhou@windriver.com>

From: Yun Zhou <yun.zhou@windriver.com>

The backport of upstream commit c143957520c6 ("ext4: validate donor
file superblock early in EXT4_IOC_MOVE_EXT") uses a bare 'return -EXDEV'
which is safe upstream because the fd is managed via CLASS(fd) with
automatic cleanup (commit 8152f8201088 ("fdget(), more trivial
conversions")).

However, on 6.12.y the ioctl still uses the traditional fdget/fdput
pattern, so the bare return bypasses fdput(donor) at the mext_out label,
leaking the file reference.

Fix by setting err and using goto mext_out.

Fixes: 74796e886ca3 ("ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT")
Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/ioctl.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -1372,8 +1372,10 @@ group_extend_out:
 			goto mext_out;
 		}
 
-		if (file_inode(filp)->i_sb != file_inode(fd_file(donor))->i_sb)
-			return -EXDEV;
+		if (file_inode(filp)->i_sb != file_inode(fd_file(donor))->i_sb) {
+			err = -EXDEV;
+			goto mext_out;
+		}
 
 		err = mnt_want_write_file(filp);
 		if (err)


Patches currently in stable-queue which might be from yun.zhou@windriver.com are

queue-6.12/ext4-fix-fd-leak-in-ext4_ioc_move_ext-cross-sb-validation.patch