ext4: update s_journal_inum if it changes after journal replay
authorBaokun Li <libaokun1@huawei.com>
Sat, 7 Jan 2023 03:21:26 +0000 (11:21 +0800)
committerTheodore Ts'o <tytso@mit.edu>
Sun, 19 Feb 2023 05:09:59 +0000 (00:09 -0500)
commit3039d8b8692408438a618fac2776b629852663c3
tree0a5ecb12895f89ed755e48f90a8ff0f3e2f39802
parent5cd740287ae5e3f9d1c46f5bfe8778972fd6d3fe
ext4: update s_journal_inum if it changes after journal replay

When mounting a crafted ext4 image, s_journal_inum may change after journal
replay, which is obviously unreasonable because we have successfully loaded
and replayed the journal through the old s_journal_inum. And the new
s_journal_inum bypasses some of the checks in ext4_get_journal(), which
may trigger a null pointer dereference problem. So if s_journal_inum
changes after the journal replay, we ignore the change, and rewrite the
current journal_inum to the superblock.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541
Reported-by: Luís Henriques <lhenriques@suse.de>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230107032126.4165860-3-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
fs/ext4/super.c