EXT4_IOC_SET_TUNE_SB_PARAM uses set_flags to indicate which superblock
fields the caller wants to update. ext4_sb_setparams() checks set_flags
before updating the other supported fields, but always copied mount_opts
into the on-disk s_mount_opts field.

As a result, callers that do not set EXT4_TUNE_FL_MOUNT_OPTS can still
clear or alter the on-disk default mount options through their unused
mount_opts buffer. This can affect subsequent mounts by changing the
filesystem's stored default mount options.

Only copy mount_opts into s_mount_opts when EXT4_TUNE_FL_MOUNT_OPTS is set,
matching the set_flags semantics used by the other tuneable superblock
fields.

Fixes: 04a91570ac67 ("ext4: implemet new ioctls to set and get superblock parameters")
Signed-off-by: guzebing <guzebing1612@gmail.com>
---
 fs/ext4/ioctl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index c8387e6a2c6e9..1f6d7afb62ec7 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -1362,7 +1362,8 @@ static void ext4_sb_setparams(struct ext4_sb_info *sbi,
 		es->s_encoding = cpu_to_le16(params->encoding);
 	if (params->set_flags & EXT4_TUNE_FL_ENCODING_FLAGS)
 		es->s_encoding_flags = cpu_to_le16(params->encoding_flags);
-	strscpy_pad(es->s_mount_opts, params->mount_opts);
+	if (params->set_flags & EXT4_TUNE_FL_MOUNT_OPTS)
+		strscpy_pad(es->s_mount_opts, params->mount_opts);
 	if (params->set_flags & EXT4_TUNE_FL_EDIT_FEATURES) {
 		es->s_feature_compat |=
 			cpu_to_le32(params->set_feature_compat_mask);
-- 
2.20.1

On Mon, Aug 10, 2026 at 11:12:00PM +0800, guzebing wrote:
> EXT4_IOC_SET_TUNE_SB_PARAM uses set_flags to indicate which superblock
> fields the caller wants to update. ext4_sb_setparams() checks set_flags
> before updating the other supported fields, but always copied mount_opts
> into the on-disk s_mount_opts field.
> 
> As a result, callers that do not set EXT4_TUNE_FL_MOUNT_OPTS can still
> clear or alter the on-disk default mount options through their unused
> mount_opts buffer. This can affect subsequent mounts by changing the
> filesystem's stored default mount options.
> 
> Only copy mount_opts into s_mount_opts when EXT4_TUNE_FL_MOUNT_OPTS is set,
> matching the set_flags semantics used by the other tuneable superblock
> fields.
> 
> Fixes: 04a91570ac67 ("ext4: implemet new ioctls to set and get superblock parameters")
> Signed-off-by: guzebing <guzebing1612@gmail.com>

Cc: <stable@vger.kernel.org> # v6.18

> ---
>  fs/ext4/ioctl.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
> index c8387e6a2c6e9..1f6d7afb62ec7 100644
> --- a/fs/ext4/ioctl.c
> +++ b/fs/ext4/ioctl.c
> @@ -1362,7 +1362,8 @@ static void ext4_sb_setparams(struct ext4_sb_info *sbi,
>  		es->s_encoding = cpu_to_le16(params->encoding);
>  	if (params->set_flags & EXT4_TUNE_FL_ENCODING_FLAGS)
>  		es->s_encoding_flags = cpu_to_le16(params->encoding_flags);
> -	strscpy_pad(es->s_mount_opts, params->mount_opts);
> +	if (params->set_flags & EXT4_TUNE_FL_MOUNT_OPTS)

Ordinarily I'd say that this is a UABI break, however, Ted never merged
the userspace code into e2fsprogs so there's no userspace to break.

Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>

--D

> +		strscpy_pad(es->s_mount_opts, params->mount_opts);
>  	if (params->set_flags & EXT4_TUNE_FL_EDIT_FEATURES) {
>  		es->s_feature_compat |=
>  			cpu_to_le32(params->set_feature_compat_mask);
> -- 
> 2.20.1
>