Theodore Ts'o 3d05e69b4e ext4: always verify the magic number in xattr blocks ... commit 513f86d73855ce556ea9522b6bfd79f87356dc3a upstream. If there an inode points to a block which is also some other type of metadata block (such as a block allocation bitmap), the buffer_verified flag can be set when it was validated as that other metadata block type; however, it would make a really terrible external attribute block. The reason why we use the verified flag is to avoid constantly reverifying the block. However, it doesn't take much overhead to make sure the magic number of the xattr block is correct, and this will avoid potential crashes. This addresses CVE-2018-10879. https://bugzilla.kernel.org/show_bug.cgi?id=200001 Signed-off-by: Theodore Ts'o <tytso@mit.edu> Reviewed-by: Andreas Dilger <adilger@dilger.ca> [Backported to 4.4: adjust context] Signed-off-by: Daniel Rosenberg <drosen@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: I06728150aefd0fffbdb6bd7cbce0858221ff6f74 (cherry picked from commit 62a28a64d87fbdce5c0a988b440a4ae6dd37b41e)		2019-03-30 07:59:30 +01:00
..
acl.c	ext4: Don't clear SGID when inheriting ACLs	2017-10-12 11:27:35 +02:00
acl.h	ext2/3/4: use generic posix ACL infrastructure	2014-01-25 23:58:19 -05:00
balloc.c	ext4: check for allocation block validity with block group locked	2018-08-06 16:24:40 +02:00
bitmap.c	ext4: remove unused header files	2015-04-02 23:47:42 -04:00
block_validity.c	ext4: call out CRC and corruption errors with specific error codes	2015-10-17 16:16:04 -04:00
crypto.c	Merge android-4.4.133 (3f51ea2) into msm-4.4	2018-05-31 12:28:38 +05:30
crypto_fname.c	BACKPORT, FROMLIST: fscrypt: add Speck128/256 support	2018-05-25 15:41:18 +00:00
crypto_key.c	Merge android-4.4.133 (3f51ea2) into msm-4.4	2018-05-31 12:28:38 +05:30
crypto_policy.c	BACKPORT, FROMLIST: fscrypt: add Speck128/256 support	2018-05-25 15:41:18 +00:00
dir.c	ext4 crypto: revalidate dentry after adding or removing the key	2017-05-08 07:46:02 +02:00
ext4.h	ext4: avoid running out of journal credits when appending to an inline file	2019-03-30 07:59:30 +01:00
ext4_crypto.h	Merge android-4.4.133 (3f51ea2) into msm-4.4	2018-05-31 12:28:38 +05:30
ext4_extents.h	ext4: verify the depth of extent tree in ext4_find_extent()	2018-07-11 16:03:48 +02:00
ext4_ice.c	ext4 crypto: enable HW based encryption with ICE	2016-09-15 00:36:43 -07:00
ext4_ice.h	ext4 crypto: enable HW based encryption with ICE	2016-09-15 00:36:43 -07:00
ext4_jbd2.c	ext4: fix potential use after free in __ext4_journal_stop	2015-10-17 22:57:06 -04:00
ext4_jbd2.h	ext4: do not perform data journaling when data is encrypted	2017-01-06 11:16:13 +01:00
extents.c	Merge android-4.4.140 (789274d) into msm-4.4	2018-07-18 15:09:28 +05:30
extents_status.c	ext4: move procfs registration code to fs/ext4/sysfs.c	2015-09-23 12:46:17 -04:00
extents_status.h	ext4: move procfs registration code to fs/ext4/sysfs.c	2015-09-23 12:46:17 -04:00
file.c	ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff()	2018-04-13 19:50:11 +02:00
fsync.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2015-04-26 17:22:07 -07:00
hash.c	ext4: remove unused header files	2015-04-02 23:47:42 -04:00
ialloc.c	ext4: fix check to prevent initializing reserved inodes	2018-08-15 17:42:04 +02:00
indirect.c	ext4: clean up feature test macros with predicate functions	2015-10-17 16:18:43 -04:00
inline.c	ext4: avoid running out of journal credits when appending to an inline file	2019-03-30 07:59:30 +01:00
inode.c	Merge android-4.4.146 (13962260) into msm-4.4	2018-08-07 15:36:56 +05:30
ioctl.c	Synchronize codes for OnePlus5 & 5T OxygenOS 9.0.0	2018-12-26 11:02:39 +08:00
Kconfig	Merge branch 'android-4.4@c71ad0f' into branch 'msm-4.4'	2017-04-20 15:19:15 -07:00
Makefile	ext4 crypto: enable HW based encryption with ICE	2016-09-15 00:36:43 -07:00
mballoc.c	This is the 4.4.152 stable release	2018-08-24 13:37:12 +02:00
mballoc.h	ext4: remove unused ac_ex_scanned	2014-02-20 13:32:10 -05:00
migrate.c	ext4: clean up feature test macros with predicate functions	2015-10-17 16:18:43 -04:00
mmp.c	ext4: call out CRC and corruption errors with specific error codes	2015-10-17 16:16:04 -04:00
move_extent.c	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
namei.c	Revert "do d_instantiate/unlock_new_inode combinations safely"	2018-07-03 16:23:54 -07:00
page-io.c	Merge branch 'android-4.4@9bc4622' into branch 'msm-4.4'	2017-06-07 09:31:32 -07:00
readpage.c	This is the 4.4.70 stable release	2017-05-25 17:31:28 +02:00
resize.c	ext4: fix fencepost error in check for inode count overflow during resize	2018-07-03 11:21:25 +02:00
super.c	This is the 4.4.148 stable release	2018-08-15 18:20:41 +02:00
symlink.c	don't put symlink bodies in pagecache into highmem	2018-02-16 20:09:38 +01:00
sysfs.c	ext4: check return value of kstrtoull correctly in reserved_clusters_store	2017-07-15 11:57:50 +02:00
truncate.h	Revert "Merge remote-tracking branch 'msm-4.4/tmp-510d0a3f' into msm-4.4"	2016-08-26 14:34:05 -07:00
xattr.c	ext4: always verify the magic number in xattr blocks	2019-03-30 07:59:30 +01:00
xattr.h	This is the 4.4.129 stable release	2018-04-24 10:42:34 +02:00
xattr_security.c	xattr handlers: Pass handler to operations instead of flags	2015-11-13 20:34:32 -05:00
xattr_trusted.c	xattr handlers: Pass handler to operations instead of flags	2015-11-13 20:34:32 -05:00
xattr_user.c	xattr handlers: Pass handler to operations instead of flags	2015-11-13 20:34:32 -05:00