| Message ID | 093b40e9df29fc102907092f4ff73461f4cfcbfd.1790343958.git.berto@igalia.com |
|---|---|
| State | New |
| Headers | show |
| Series | ext4: refuse encryption when block size > page size | expand |
> Encryption is not supported when a filesystem's block size is larger > than the page size, and commit 709f0f1f1bf5 ("ext4: add checks for > large folio incompatibilities when BS > PS") added a check to refuse > mounting such a filesystem. > > However, it is also possible to enable the "encrypt" feature on a > filesystem that is already mounted (with tune2fs -O encrypt). Once > that happens it won't be possible to mount the filesystem again in > the future, but there is nothing preventing the user from setting an > encryption policy while the filesystem is still mounted. > > Fix this by refusing to set an fscrypt context in ext4_set_context() > when the block size is larger than the page size. > > Fixes: 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS") > Cc: stable@vger.kernel.org # v6.19+ > Signed-off-by: Alberto Garcia <berto@igalia.com> Sashiko has reviewed this patch and found no issues. It looks great!
On 2026/9/25 22:19, Alberto Garcia wrote: > Encryption is not supported when a filesystem's block size is larger > than the page size, and commit 709f0f1f1bf5 ("ext4: add checks for > large folio incompatibilities when BS > PS") added a check to refuse > mounting such a filesystem. > > However, it is also possible to enable the "encrypt" feature on a > filesystem that is already mounted (with tune2fs -O encrypt). Once > that happens it won't be possible to mount the filesystem again in > the future, but there is nothing preventing the user from setting an > encryption policy while the filesystem is still mounted. > > Fix this by refusing to set an fscrypt context in ext4_set_context() > when the block size is larger than the page size. > > Fixes: 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS") > Cc: stable@vger.kernel.org # v6.19+ > Signed-off-by: Alberto Garcia <berto@igalia.com> Thanks for the patch, feel free to add: Reviewed-by: Baokun Li <libaokun@linux.alibaba.com> > --- > fs/ext4/crypto.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c > index 1a0fccb084ef..318b2eaea741 100644 > --- a/fs/ext4/crypto.c > +++ b/fs/ext4/crypto.c > @@ -156,6 +156,15 @@ static int ext4_set_context(struct inode *inode, const void *ctx, size_t len, > if (ext4_test_inode_flag(inode, EXT4_INODE_DAX)) > return -EOPNOTSUPP; > > + /* > + * Encryption is not supported when the block size is larger > + * than the page size. This is rejected at mount time by > + * ext4_check_large_folio(), and this check here is for the case > + * when the 'encrypt' feature is enabled on a mounted filesystem. > + */ > + if (inode->i_sb->s_blocksize > PAGE_SIZE) > + return -EOPNOTSUPP; > + > res = ext4_convert_inline_data(inode); > if (res) > return res;
diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c index 1a0fccb084ef..318b2eaea741 100644 --- a/fs/ext4/crypto.c +++ b/fs/ext4/crypto.c @@ -156,6 +156,15 @@ static int ext4_set_context(struct inode *inode, const void *ctx, size_t len, if (ext4_test_inode_flag(inode, EXT4_INODE_DAX)) return -EOPNOTSUPP; + /* + * Encryption is not supported when the block size is larger + * than the page size. This is rejected at mount time by + * ext4_check_large_folio(), and this check here is for the case + * when the 'encrypt' feature is enabled on a mounted filesystem. + */ + if (inode->i_sb->s_blocksize > PAGE_SIZE) + return -EOPNOTSUPP; + res = ext4_convert_inline_data(inode); if (res) return res;
Encryption is not supported when a filesystem's block size is larger than the page size, and commit 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS") added a check to refuse mounting such a filesystem. However, it is also possible to enable the "encrypt" feature on a filesystem that is already mounted (with tune2fs -O encrypt). Once that happens it won't be possible to mount the filesystem again in the future, but there is nothing preventing the user from setting an encryption policy while the filesystem is still mounted. Fix this by refusing to set an fscrypt context in ext4_set_context() when the block size is larger than the page size. Fixes: 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS") Cc: stable@vger.kernel.org # v6.19+ Signed-off-by: Alberto Garcia <berto@igalia.com> --- fs/ext4/crypto.c | 9 +++++++++ 1 file changed, 9 insertions(+)