]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
ext4: Make sure quota files are not grabbed accidentally
authorJan Kara <jack@suse.cz>
Thu, 12 Aug 2021 13:31:22 +0000 (15:31 +0200)
committerTheodore Ts'o <tytso@mit.edu>
Tue, 31 Aug 2021 03:36:50 +0000 (23:36 -0400)
If ext4 filesystem is corrupted so that quota files are linked from
directory hirerarchy, bad things can happen. E.g. quota files can get
corrupted or deleted. Make sure we are not grabbing quota file inodes
when we expect normal inodes.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20210812133122.26360-1-jack@suse.cz
fs/ext4/inode.c

index d8de607849df3e20a8eae11f53dd019fbcb63185..2c33c795c4a7f512f724647a5739bd040895defa 100644 (file)
@@ -4603,6 +4603,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
        struct ext4_iloc iloc;
        struct ext4_inode *raw_inode;
        struct ext4_inode_info *ei;
+       struct ext4_super_block *es = EXT4_SB(sb)->s_es;
        struct inode *inode;
        journal_t *journal = EXT4_SB(sb)->s_journal;
        long ret;
@@ -4613,9 +4614,12 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
        projid_t i_projid;
 
        if ((!(flags & EXT4_IGET_SPECIAL) &&
-            (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) ||
+            ((ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) ||
+             ino == le32_to_cpu(es->s_usr_quota_inum) ||
+             ino == le32_to_cpu(es->s_grp_quota_inum) ||
+             ino == le32_to_cpu(es->s_prj_quota_inum))) ||
            (ino < EXT4_ROOT_INO) ||
-           (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) {
+           (ino > le32_to_cpu(es->s_inodes_count))) {
                if (flags & EXT4_IGET_HANDLE)
                        return ERR_PTR(-ESTALE);
                __ext4_error(sb, function, line, false, EFSCORRUPTED, 0,