tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

ext4: Make sure quota files are not grabbed accidentally

If ext4 filesystem is corrupted so that quota files are linked from
directory hirerarchy, bad things can happen. E.g. quota files can get
corrupted or deleted. Make sure we are not grabbing quota file inodes
when we expect normal inodes.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20210812133122.26360-1-jack@suse.cz

authored by

Jan Kara and committed by
Theodore Ts'o bd2c38cf b2bbb92f

+6 -2
+6 -2
fs/ext4/inode.c
··· 4603 4603 struct ext4_iloc iloc; 4604 4604 struct ext4_inode *raw_inode; 4605 4605 struct ext4_inode_info *ei; 4606 + struct ext4_super_block *es = EXT4_SB(sb)->s_es; 4606 4607 struct inode *inode; 4607 4608 journal_t *journal = EXT4_SB(sb)->s_journal; 4608 4609 long ret; ··· 4614 4613 projid_t i_projid; 4615 4614 4616 4615 if ((!(flags & EXT4_IGET_SPECIAL) && 4617 - (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) || 4616 + ((ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) || 4617 + ino == le32_to_cpu(es->s_usr_quota_inum) || 4618 + ino == le32_to_cpu(es->s_grp_quota_inum) || 4619 + ino == le32_to_cpu(es->s_prj_quota_inum))) || 4618 4620 (ino < EXT4_ROOT_INO) || 4619 - (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) { 4621 + (ino > le32_to_cpu(es->s_inodes_count))) { 4620 4622 if (flags & EXT4_IGET_HANDLE) 4621 4623 return ERR_PTR(-ESTALE); 4622 4624 __ext4_error(sb, function, line, false, EFSCORRUPTED, 0,