From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, "tytso@mit.edu,
adilger.kernel@dilger.ca, linux-ext4@vger.kernel.org,
linux-kernel@vger.kernel.org, joneslee@google.com,
Tudor Ambarus" <tudor.ambarus@linaro.org>,
Tudor Ambarus <tudor.ambarus@linaro.org>
Subject: [PATCH 4.14 18/28] Revert "ext4: fix use-after-free in ext4_xattr_set_entry"
Date: Mon, 24 Apr 2023 15:18:39 +0200 [thread overview]
Message-ID: <20230424131121.918926414@linuxfoundation.org> (raw)
In-Reply-To: <20230424131121.331252806@linuxfoundation.org>
From: Tudor Ambarus <tudor.ambarus@linaro.org>
This reverts commit bb8592efcf8ef2f62947745d3182ea05b5256a15 which is
commit 67d7d8ad99beccd9fe92d585b87f1760dc9018e3 upstream.
The order in which patches are queued to stable matters. This patch
has a logical dependency on commit 310c097c2bdbea253d6ee4e064f3e65580ef93ac
upstream, and failing to queue the latter results in a null-ptr-deref
reported at the Link below.
In order to avoid conflicts on stable, revert the commit just so that we
can queue its prerequisite patch first and then queue the same after.
Link: https://syzkaller.appspot.com/bug?extid=d5ebf56f3b1268136afd
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/xattr.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -2200,9 +2200,8 @@ int ext4_xattr_ibody_find(struct inode *
struct ext4_inode *raw_inode;
int error;
- if (!EXT4_INODE_HAS_XATTR_SPACE(inode))
+ if (EXT4_I(inode)->i_extra_isize == 0)
return 0;
-
raw_inode = ext4_raw_inode(&is->iloc);
header = IHDR(inode, raw_inode);
is->s.base = is->s.first = IFIRST(header);
@@ -2230,9 +2229,8 @@ int ext4_xattr_ibody_inline_set(handle_t
struct ext4_xattr_search *s = &is->s;
int error;
- if (!EXT4_INODE_HAS_XATTR_SPACE(inode))
+ if (EXT4_I(inode)->i_extra_isize == 0)
return -ENOSPC;
-
error = ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */);
if (error)
return error;
next prev parent reply other threads:[~2023-04-24 13:37 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-24 13:18 [PATCH 4.14 00/28] 4.14.314-rc1 review Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 01/28] ARM: dts: rockchip: fix a typo error for rk3288 spdif node Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 02/28] net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 03/28] virtio_net: bugfix overflow inside xdp_linearize_page() Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 04/28] i40e: fix accessing vsi->active_filters without holding lock Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 05/28] i40e: fix i40e_setup_misc_vector() error handling Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 06/28] mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 07/28] e1000e: Disable TSO on i219-LM card to increase speed Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 08/28] f2fs: Fix f2fs_truncate_partial_nodes ftrace event Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 09/28] selftests: sigaltstack: fix -Wuninitialized Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 10/28] scsi: megaraid_sas: Fix fw_crash_buffer_show() Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 11/28] scsi: core: Improve scsi_vpd_inquiry() checks Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 12/28] net: dsa: b53: mmap: add phy ops Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 13/28] s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 14/28] xen/netback: use same error messages for same errors Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 15/28] nilfs2: initialize unused bytes in segment summary blocks Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 16/28] memstick: fix memory leak if card device is never registered Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 17/28] x86/purgatory: Dont generate debug info for purgatory.ro Greg Kroah-Hartman
2023-04-24 13:18 ` Greg Kroah-Hartman [this message]
2023-04-24 13:18 ` [PATCH 4.14 19/28] ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 20/28] ext4: fix use-after-free in ext4_xattr_set_entry Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 21/28] udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM) Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 22/28] tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct() Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 23/28] inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy() Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 24/28] dccp: Call inet6_destroy_sock() via sk->sk_destruct() Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 25/28] sctp: " Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 26/28] counter: 104-quad-8: Fix race condition between FLAG and CNTR reads Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 27/28] iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() Greg Kroah-Hartman
2023-04-24 13:18 ` [PATCH 4.14 28/28] ASN.1: Fix check for strdup() success Greg Kroah-Hartman
2023-04-25 1:03 ` [PATCH 4.14 00/28] 4.14.314-rc1 review Guenter Roeck
2023-04-25 9:22 ` Naresh Kamboju
2023-04-25 10:43 ` Chris Paterson
2023-04-25 13:58 ` Harshit Mogalapalli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230424131121.918926414@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
--cc=tudor.ambarus@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).