[PATCH v2] ubifs: fix host inode TNC offset when deleting an xattr

[Nan Lin]

ubifs_jnl_delete_xattr() writes a group of three nodes: the xent, the
xattr inode and the host inode. The host inode is packed at
xent_offs + aligned_xlen + UBIFS_INO_NODE_SZ, but its TNC position is
computed backwards as xent_offs + len - hlen. Since len includes the
group's tail padding, ALIGN(hlen, 8) - hlen, the two differ whenever
the host inode's inline data length is not a multiple of 8. This
affects symlinks and device nodes.

The unaligned offset ends up in the on-flash index and the next mount
rejects the index node, turning the filesystem read-only.

Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
Cc: stable@xxxxxxxxxxxxxxx
Tested-by: Zhihao Cheng <chengzhihao1@xxxxxxxxxx>
Signed-off-by: Nan Lin <lin.nan@xxxxxxx>

Changes since v1:
 - compute the host inode offset into a new host_offs variable instead
   of open-coding the offset (Richard Weinberger);
 - shorten the commit message.

---
 fs/ubifs/journal.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index 40a95a2fad50..0b2dae57e467 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -1858,7 +1858,8 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host,
 			   const struct inode *inode,
 			   const struct fscrypt_name *nm)
 {
-	int err, xlen, hlen, len, lnum, xent_offs, aligned_xlen, write_len;
+	int err, xlen, hlen, len, lnum, xent_offs, host_offs, aligned_xlen,
+		write_len;
 	struct ubifs_dent_node *xent;
 	struct ubifs_ino_node *ino;
 	union ubifs_key xent_key, key1, key2;
@@ -1915,6 +1916,8 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host,
 		ubifs_wbuf_add_ino_nolock(&c->jheads[BASEHD].wbuf, host->i_ino);
 	release_head(c, BASEHD);
 
+	host_offs = xent_offs + aligned_xlen + UBIFS_INO_NODE_SZ;
+
 	ubifs_add_auth_dirt(c, lnum);
 	kfree(xent);
 	if (err)
@@ -1943,7 +1946,7 @@ int ubifs_jnl_delete_xattr(struct ubifs_info *c, const struct inode *host,
 
 	/* And update TNC with the new host inode position */
 	ino_key_init(c, &key1, host->i_ino);
-	err = ubifs_tnc_add(c, &key1, lnum, xent_offs + len - hlen, hlen, hash);
+	err = ubifs_tnc_add(c, &key1, lnum, host_offs, hlen, hash);
 	if (err)
 		goto out_ro;
 
-- 
2.33.0