linux-ext4 - [PATCH] ext4: swap i_disksize when swaping the boot loader inode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230308041252.GC860405@mit.edu>
Date:   Tue, 7 Mar 2023 23:12:52 -0500
From:   "Theodore Ts'o" <tytso@....edu>
To:     bugzilla-daemon@...nel.org
Cc:     linux-ext4@...r.kernel.org, chengzhihao1@...wei.com
Subject: [PATCH] ext4: swap i_disksize when swaping the boot loader inode

The following patch fixes the reported issue.

>From f4e156cef119f3ffcc56874da4fb9299cc14f68e Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@....edu>
Date: Tue, 7 Mar 2023 23:06:59 -0500
Subject: [PATCH] ext4: swap i_disksize when swaping the boot loader inode

Normally well-behaved of EXT4_IOC_SWAP_BOOT won't actually try to
write to the either inode after using the ioctl, but if they do, the
fact that we're not swapping ei->i_disksize as well as inode->i_size
can trigger warnings.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=217159
Signed-off-by: Theodore Ts'o <tytso@....edu>
---
 fs/ext4/ioctl.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 2e8c34036313..e552c5db0c95 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -329,9 +329,13 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2)
 	ext4_es_remove_extent(inode1, 0, EXT_MAX_BLOCKS);
 	ext4_es_remove_extent(inode2, 0, EXT_MAX_BLOCKS);
 
-	isize = i_size_read(inode1);
-	i_size_write(inode1, i_size_read(inode2));
-	i_size_write(inode2, isize);
+	/*
+	 * Both inodes are locked, so we don't need to fool around
+	 * with i_size_read() and i_size_write().
+	 */
+	isize = inode1->i_size;
+	inode1->i_size = ei1->i_disksize = inode2->i_size;
+	inode2->i_size = ei2->i_disksize = isize;
 }
 
 void ext4_reset_inode_seed(struct inode *inode)
-- 
2.31.0