CVE-2025-68264

In the Linux kernel, the following vulnerability has been resolved:

ext4: refresh inline data size before write operations

The cached ei->i_inline_size can become stale between the initial size

check and when ext4_update_inline_data()/ext4_create_inline_data() use

it. Although ext4_get_max_inline_size() reads the correct value at the

time of the check, concurrent xattr operations can modify i_inline_size

before ext4_write_lock_xattr() is acquired.

This causes ext4_update_inline_data() and ext4_create_inline_data() to

work with stale capacity values, leading to a BUG_ON() crash in

ext4_write_inline_data():

kernel BUG at fs/ext4/inline.c:1331!

BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);

The race window:

1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)

2. Size check passes for 50-byte write

3. [Another thread adds xattr, i_inline_size changes to 40]

4. ext4_write_lock_xattr() acquires lock

5. ext4_update_inline_data() uses stale i_inline_size = 60

6. Attempts to write 50 bytes but only 40 bytes actually available

7. BUG_ON() triggers

Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock()

immediately after acquiring xattr_sem. This ensures ext4_update_inline_data()

and ext4_create_inline_data() work with current values that are protected

from concurrent modifications.

This is similar to commit a54c4613dac1 ("ext4: fix race writing to an

inline_data file while its xattrs are changing") which fixed i_inline_off

staleness. This patch addresses the related i_inline_size staleness issue.