ext4: update s_journal_inum if it changes after journal replay
authorBaokun Li <libaokun1@huawei.com>
Sat, 7 Jan 2023 03:21:26 +0000 (11:21 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Mar 2023 12:31:31 +0000 (13:31 +0100)
commit499fef2030fb754c68b1c7cb3a799a3bc1d0d925
treeae4da32b7a1e82b4ac54676559eaab3b6efa9355
parent088da6b80539816e22656df0e5333e06a43316a8
ext4: update s_journal_inum if it changes after journal replay

[ Upstream commit 3039d8b8692408438a618fac2776b629852663c3 ]

When mounting a crafted ext4 image, s_journal_inum may change after journal
replay, which is obviously unreasonable because we have successfully loaded
and replayed the journal through the old s_journal_inum. And the new
s_journal_inum bypasses some of the checks in ext4_get_journal(), which
may trigger a null pointer dereference problem. So if s_journal_inum
changes after the journal replay, we ignore the change, and rewrite the
current journal_inum to the superblock.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541
Reported-by: Luís Henriques <lhenriques@suse.de>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230107032126.4165860-3-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/ext4/super.c