The call to nd_terminate_link() clamps the size to min(i_size,
sizeof(ei->i_data) - 1), while the subsequent call to
inode_set_cached_link() fails the possible update.
The kernel used to always strlen(), so do it now as well.
Reported-by: syzbot+48a99e426f29859818c0@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: bae80473f7b0 ("ext4: use inode_set_cached_link()")
Signed-off-by: Mateusz Guzik <mjguzik@xxxxxxxxx>
---
Per my comments in:
https://lore.kernel.org/all/CAGudoHEv+Diti3r0x9VmF5ixgRVKk4trYnX_skVJNkQoTMaDHg@xxxxxxxxxxxxxx/#t
There is definitely a pre-existing bug in ext4 which the above happens
to run into. I suspect the nd_terminate_link thing will disappear once
that gets sorted out.
In the meantime the appropriate fix for 6.14 is to restore the original
behavior of issuing strlen.
syzbot verified the issue is fixed:
https://lore.kernel.org/linux-hardening/67a381a3.050a0220.50516.0077.GAE@xxxxxxxxxx/T/#m340e6b52b9547ac85471a1da5980fe0a67c790ac
fs/ext4/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 7c54ae5fcbd4..30cff983e601 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5010,7 +5010,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
nd_terminate_link(ei->i_data, inode->i_size,
sizeof(ei->i_data) - 1);
inode_set_cached_link(inode, (char *)ei->i_data,
- inode->i_size);
+ strlen((char *)ei->i_data));
} else {
inode->i_op = &ext4_symlink_inode_operations;
}
--
2.43.0
