linux-stable/fs
Andreas Dilger 0b92af41f7 ext4: check fast symlink for ea_inode correctly
commit b4cc4a4077 upstream.

The check for a fast symlink in the presence of only an
external xattr inode is incorrect.  If a fast symlink does
not have an xattr block (i_file_acl == 0), but does have
an external xattr inode that increases inode i_blocks, then
the check for a fast symlink will incorrectly fail and
__ext4_iget()->ext4_ind_check_inode() will report the inode
is corrupt when it "validates" i_data[] on the next read:

    # ln -s foo /mnt/tmp/bar
    # setfattr -h -n trusted.test \
               -v "$(yes | head -n 4000)" /mnt/tmp/bar
    # umount /mnt/tmp
    # mount /mnt/tmp
    # ls -l /mnt/tmp
    ls: cannot access '/mnt/tmp/bar': Structure needs cleaning
    total 4
     ? l?????????? ? ?    ?        ?            ? bar
    # dmesg | tail -1
    EXT4-fs error (device dm-8): __ext4_iget:5098:
        inode #24578: block 7303014: comm ls: invalid block

(note that "block 7303014" = 0x6f6f66 = "foo" in LE order).

ext4_inode_is_fast_symlink() should check the superblock
EXT4_FEATURE_INCOMPAT_EA_INODE feature flag, not the inode
EXT4_EA_INODE_FL, since the latter is only set on the xattr
inode itself, and not on the inode that uses this xattr.

Cc: stable@vger.kernel.org
Fixes: fc82228a5e ("ext4: support fast symlinks from ext3 file systems")
Signed-off-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-by: Li Dongyang <dongyangli@ddn.com>
Reviewed-by: Alex Zhuravlev <bzzz@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>
Reviewed-on: https://review.whamcloud.com/59879
Lustre-bug-id: https://jira.whamcloud.com/browse/LU-19121
Link: https://patch.msgid.link/20250717063709.757077-1-adilger@dilger.ca
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:21:31 +02:00
..
9p
adfs
affs
afs
autofs
befs
bfs
btrfs btrfs: fix log tree replay failure due to file with 0 links and extents 2025-08-28 16:21:30 +02:00
cachefiles
ceph ceph: fix possible integer overflow in ceph_zero_objects() 2025-07-17 18:24:50 +02:00
cifs cifs: Fix calling CIFSFindFirst() for root path without msearch 2025-08-28 16:21:27 +02:00
coda
configfs configfs: Do not override creating attribute file failure in populate_attrs() 2025-06-27 11:02:50 +01:00
cramfs
crypto
debugfs
devpts
dlm
ecryptfs
efivarfs
efs
erofs
exportfs
ext2
ext4 ext4: check fast symlink for ea_inode correctly 2025-08-28 16:21:31 +02:00
f2fs f2fs: fix to avoid out-of-boundary access in devs.path 2025-08-28 16:21:22 +02:00
fat
freevxfs
fscache
fuse virtiofs: add filesystem context source name check 2025-05-02 07:39:21 +02:00
gfs2 gfs2: move msleep to sleepable context 2025-06-27 11:02:50 +01:00
hfs hfs: fix not erasing deleted b-tree node issue 2025-08-28 16:21:24 +02:00
hfsplus hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() 2025-08-28 16:21:24 +02:00
hostfs
hpfs
hugetlbfs
iomap
isofs isofs: Verify inode mode when loading from disk 2025-08-28 16:21:15 +02:00
jbd2 jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() 2025-06-27 11:02:58 +01:00
jffs2 jffs2: check jffs2_prealloc_raw_node_refs() result in few other places 2025-06-27 11:02:56 +01:00
jfs jfs: upper bound check of tree index in dbAllocAG 2025-08-28 16:21:28 +02:00
kernfs
lockd
minix
nfs pNFS: Fix uninited ptr deref in block/scsi layout 2025-08-28 16:21:29 +02:00
nfs_common
nfsd NFSD: detect mismatch of file handle and delegation stateid in OPEN op 2025-08-28 16:21:23 +02:00
nilfs2 nilfs2: reject invalid file types when reading inodes 2025-08-28 16:21:18 +02:00
nls
notify
ntfs
ocfs2 ocfs2: stop quota recovery before disabling quotas 2025-06-04 14:32:27 +02:00
omfs
openpromfs
orangefs fs/orangefs: use snprintf() instead of sprintf() 2025-08-28 16:21:27 +02:00
overlayfs ovl: Check for NULL d_inode() in ovl_dentry_upper() 2025-07-17 18:24:51 +02:00
proc fix proc_sys_compare() handling of in-lookup dentries 2025-07-17 18:25:01 +02:00
pstore
qnx4
qnx6
quota
ramfs
reiserfs
romfs
squashfs Squashfs: check return result of sb_min_blocksize 2025-06-27 11:02:47 +01:00
sysfs
sysv
tracefs
ubifs
udf udf: Verify partition map count 2025-08-28 16:21:24 +02:00
ufs
unicode
verity
xfs
aio.c
anon_inodes.c
attr.c
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c
buffer.c
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c
compat.c
coredump.c coredump: hand a pidfd to the usermode coredump helper 2025-06-04 14:32:36 +02:00
d_path.c
dax.c
dcache.c
dcookies.c
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c
exec.c
fcntl.c
fhandle.c
file_table.c
file.c fs: Prevent file descriptor table allocations exceeding INT_MAX 2025-08-28 16:21:23 +02:00
filesystems.c fs/filesystems: Fix potential unsigned integer underflow in fs_name() 2025-06-27 11:02:50 +01:00
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c
fsopen.c
inode.c
internal.h
io_uring.c
ioctl.c
Kconfig nfs: add missing selections of CONFIG_CRC32 2025-05-02 07:39:20 +02:00
Kconfig.binfmt
libfs.c
locks.c
Makefile
mbcache.c
mount.h
mpage.c
namei.c
namespace.c attach_recursive_mnt(): do not lock the covering tree when sliding something under it 2025-07-17 18:24:53 +02:00
no-block.c
nsfs.c
open.c
pipe.c
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c
select.c
seq_file.c
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c
sync.c
timerfd.c
userfaultfd.c
utimes.c
xattr.c