From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl0-f66.google.com ([209.85.160.66]:46153 "EHLO mail-pl0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752514AbeDTW0z (ORCPT ); Fri, 20 Apr 2018 18:26:55 -0400 Received: by mail-pl0-f66.google.com with SMTP id 59-v6so5962748plc.13 for ; Fri, 20 Apr 2018 15:26:55 -0700 (PDT) From: Harsh Shandilya To: stable@vger.kernel.org Cc: Theodore Ts'o , Harsh Shandilya Subject: [PATCH 4/4] ext4: force revalidation of directory pointer after seekdir(2) Date: Sat, 21 Apr 2018 03:56:12 +0530 Message-Id: <20180420222612.18881-5-harsh@prjkt.io> In-Reply-To: <20180420222612.18881-1-harsh@prjkt.io> References: <20180420222612.18881-1-harsh@prjkt.io> Sender: stable-owner@vger.kernel.org List-ID: From: Theodore Ts'o A malicious user could force the directory pointer to be in an invalid spot by using seekdir(2). Use the mechanism we already have to notice if the directory has changed since the last time we called ext4_readdir() to force a revalidation of the pointer. Reported-by: syzbot+1236ce66f79263e8a862@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o Cc: stable@vger.kernel.org Signed-off-by: Harsh Shandilya --- fs/ext4/dir.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c index c24143ea9c08..99f72558b33a 100644 --- a/fs/ext4/dir.c +++ b/fs/ext4/dir.c @@ -320,13 +320,15 @@ static loff_t ext4_dir_llseek(struct file *file, loff_t offset, int whence) { struct inode *inode = file->f_mapping->host; int dx_dir = is_dx_dir(inode); - loff_t htree_max = ext4_get_htree_eof(file); + loff_t ret, htree_max = ext4_get_htree_eof(file); if (likely(dx_dir)) - return generic_file_llseek_size(file, offset, whence, + ret = generic_file_llseek_size(file, offset, whence, htree_max, htree_max); else - return ext4_llseek(file, offset, whence); + ret = ext4_llseek(file, offset, whence); + file->f_version = inode_peek_iversion(inode) - 1; + return ret; } /* -- 2.15.0.2308.g658a28aa74af