ubifs_jnl_delete_xattr() writes a group of three nodes: the xent, the xattr inode and the host inode. The host inode is packed at xent_offs + aligned_xlen + UBIFS_INO_NODE_SZ, but its TNC position is computed backwards as xent_offs + len - hlen. Since len includes the group's tail padding, ALIGN(hlen, 8) - hlen, the two differ whenever the host inode's inline data length is not a multiple of 8. This affects symlinks and device nodes. The unaligned offset ends up in the on-flash index and the next mount rejects the index node, turning the filesystem read-only. Fixes: 1e51764a3c2a ("UBIFS: add new flash file system") Cc: stable@vger.kernel.org Tested-by: Zhihao Cheng Signed-off-by: Nan Lin Changes since v1: - compute the host inode offset into a new host_offs variable instead of open-coding the offset (Richard Weinberger); - shorten the commit message. --- fs/ubifs/journal.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c index 40a95a2fad50..0b2dae57e467 100644 --- a/fs/ubifs/journal.c +++ b/fs/ubifs/journal.c @@ -1858,7 +1858,8 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host, const struct inode *inode, const struct fscrypt_name *nm) { - int err, xlen, hlen, len, lnum, xent_offs, aligned_xlen, write_len; + int err, xlen, hlen, len, lnum, xent_offs, host_offs, aligned_xlen, + write_len; struct ubifs_dent_node *xent; struct ubifs_ino_node *ino; union ubifs_key xent_key, key1, key2; @@ -1915,6 +1916,8 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host, ubifs_wbuf_add_ino_nolock(&c->jheads[BASEHD].wbuf, host->i_ino); release_head(c, BASEHD); + host_offs = xent_offs + aligned_xlen + UBIFS_INO_NODE_SZ; + ubifs_add_auth_dirt(c, lnum); kfree(xent); if (err) @@ -1943,7 +1946,7 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host, /* And update TNC with the new host inode position */ ino_key_init(c, &key1, host->i_ino); - err = ubifs_tnc_add(c, &key1, lnum, xent_offs + len - hlen, hlen, hash); + err = ubifs_tnc_add(c, &key1, lnum, host_offs, hlen, hash); if (err) goto out_ro; -- 2.33.0