ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode

commit 63b1e9bccb71fe7d7e3ddc9877dbdc85e5d2d023 upstream.

There are many places that will get unhappy (and crash) when ext4_iget()
returns a bad inode. However, if iget the boot loader inode, allows a bad
inode to be returned, because the inode may not be initialized. This
mechanism can be used to bypass some checks and cause panic. To solve this
problem, we add a special iget flag EXT4_IGET_BAD. Only with this flag
we'd be returning bad inode from ext4_iget(), otherwise we always return
the error code if the inode is bad inode.(suggested by Jan Kara)

Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20221026042310.3839669-4-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index ae4f13c8fc8d892b1f892114d37ffd69f94aca3f..bbbb6881f930b4b53c43458b068440315a6ff323 100644 (file)
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2996,7 +2996,8 @@ int do_journal_get_write_access(handle_t *handle, struct inode *inode,
 typedef enum {
        EXT4_IGET_NORMAL =      0,
        EXT4_IGET_SPECIAL =     0x0001, /* OK to iget a system inode */
-       EXT4_IGET_HANDLE =      0x0002  /* Inode # is from a handle */
+       EXT4_IGET_HANDLE =      0x0002, /* Inode # is from a handle */
+       EXT4_IGET_BAD =         0x0004  /* Allow to iget a bad inode */
 } ext4_iget_flags;
 
 extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 6c35e5fba3949f60c2585754156fbfadff5a56b8..f449c1249f58914b40b3bae90b6a16ec7850a44b 100644 (file)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4885,8 +4885,14 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
        if (IS_CASEFOLDED(inode) && !ext4_has_feature_casefold(inode->i_sb))
                ext4_error_inode(inode, function, line, 0,
                                 "casefold flag without casefold feature");
-       brelse(iloc.bh);
+       if (is_bad_inode(inode) && !(flags & EXT4_IGET_BAD)) {
+               ext4_error_inode(inode, function, line, 0,
+                                "bad inode without EXT4_IGET_BAD flag");
+               ret = -EUCLEAN;
+               goto bad_inode;
+       }
 
+       brelse(iloc.bh);
        unlock_new_inode(inode);
        return inode;
 

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index f61b59045c6d3a6e59a1262b2b559defd26a7f58..10d489ee75bc2deb7f09b964990f3d960a049e3f 100644 (file)
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -124,7 +124,8 @@ static long swap_inode_boot_loader(struct super_block *sb,
        blkcnt_t blocks;
        unsigned short bytes;
 
-       inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO, EXT4_IGET_SPECIAL);
+       inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO,
+                       EXT4_IGET_SPECIAL | EXT4_IGET_BAD);
        if (IS_ERR(inode_bl))
                return PTR_ERR(inode_bl);
        ei_bl = EXT4_I(inode_bl);