From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B457C7618B for ; Wed, 15 Mar 2023 12:18:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231881AbjCOMSj (ORCPT ); Wed, 15 Mar 2023 08:18:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43510 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231921AbjCOMS2 (ORCPT ); Wed, 15 Mar 2023 08:18:28 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C4E3E20043 for ; Wed, 15 Mar 2023 05:18:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 79EBBB81DF8 for ; Wed, 15 Mar 2023 12:18:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E5C57C433D2; Wed, 15 Mar 2023 12:18:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1678882696; bh=+jOMzRhQoMG3kX3q0ET2sABYWpshA/EwcPYNTSZIRig=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dqLUFDK1NmjhFQh4/yMmU0RsNy2SgQkzW/S41dR3LUvHVoUxEhfJH2GL7aa/sJHp8 WsRA9CIuT9vrTTyrr1V1FgmPHWTj0mHLGWSeLY5b6ax3L4FNru55k/pHbiZUfx99QC 216grCKQpg8wNGsmzytj7eDH+6b9TCHJBK7MRqP0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jan Kara , Theodore Tso , Sasha Levin Subject: [PATCH 5.4 35/68] ext4: Fix possible corruption when moving a directory Date: Wed, 15 Mar 2023 13:12:29 +0100 Message-Id: <20230315115727.478372821@linuxfoundation.org> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230315115726.103942885@linuxfoundation.org> References: <20230315115726.103942885@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jan Kara [ Upstream commit 0813299c586b175d7edb25f56412c54b812d0379 ] When we are renaming a directory to a different directory, we need to update '..' entry in the moved directory. However nothing prevents moved directory from being modified and even converted from the inline format to the normal format. When such race happens the rename code gets confused and we crash. Fix the problem by locking the moved directory. CC: stable@vger.kernel.org Fixes: 32f7f22c0b52 ("ext4: let ext4_rename handle inline dir") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230126112221.11866-1-jack@suse.cz Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin --- fs/ext4/namei.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index 30c37ef8b8af3..f9d11f59df7d2 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -3855,9 +3855,16 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, if (new.dir != old.dir && EXT4_DIR_LINK_MAX(new.dir)) goto end_rename; } + /* + * We need to protect against old.inode directory getting + * converted from inline directory format into a normal one. + */ + inode_lock_nested(old.inode, I_MUTEX_NONDIR2); retval = ext4_rename_dir_prepare(handle, &old); - if (retval) + if (retval) { + inode_unlock(old.inode); goto end_rename; + } } /* * If we're renaming a file within an inline_data dir and adding or @@ -3953,6 +3960,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, } else { ext4_journal_stop(handle); } + if (old.dir_bh) + inode_unlock(old.inode); release_bh: brelse(old.dir_bh); brelse(old.bh); -- 2.39.2