Re: [PATCH -next] ext4: fix use-after-free in ext4_rename_dir_prepare

Theodore Ts'o
2022-05-13T21:53:43Z

On Fri, May 13, 2022 at 05:13:47PM -0400, Theodore Ts'o wrote:
>
> I think we should be calling ext4_error_inode()? If the directory is
> missing '.' or '..' below, the file system is corrupt, so we probably
> should mark the file system as inconsistent, so that e2fsck can fix
> the file system.

I noticed one other problem; which is that by returning NULL and not
setting retval, ext4_rename_dir_prepare() will end up returning
uninitialized stack garbage as the "error code".

So I'm going to be applying this commit with the following change:

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 50be41dc5831..b202626391ff 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -3471,8 +3471,9 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle,
bh->b_size, 0) ||
le32_to_cpu(de->inode) != inode->i_ino ||
strcmp(".", de->name)) {
- ext4_warning_inode(inode, "directory missing '.'");
+ EXT4_ERROR_INODE(inode, "directory missing '.'");
brelse(bh);
+ *retval = -EFSCORRUPTED;
return NULL;
}
offset = ext4_rec_len_from_disk(de->rec_len,
@@ -3481,8 +3482,9 @@ static struct buffer_head *ext4_get_first_dir_block(handle_t *handle,
if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data,
bh->b_size, offset) ||
le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) {
- ext4_warning_inode(inode, "directory missing '..'");
+ EXT4_ERROR_INODE(inode, "directory missing '..'");
brelse(bh);
+ *retval = -EFSCORRUPTED;
return NULL;
}
*parent_de = de;