diff options
| author | Eric Biggers <ebiggers@google.com> | 2016-12-01 14:51:58 -0500 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2016-12-01 14:51:58 -0500 |
| commit | 290ab230016f187c3551d8380ea742889276d03a (patch) | |
| tree | 051138c85bb6f7d8ac52513ecfb510832cee9220 /fs/ext4/xattr.c | |
| parent | 2dc8d9e19b0d891b0d3675b5ac82be9be3875e36 (diff) | |
ext4: don't read out of bounds when checking for in-inode xattrs
With i_extra_isize equal to or close to the available space, it was
possible for us to read past the end of the inode when trying to detect
or validate in-inode xattrs. Fix this by checking for the needed extra
space first.
This patch shouldn't have any noticeable effect on
non-corrupted/non-malicious filesystems.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Diffstat (limited to 'fs/ext4/xattr.c')
| -rw-r--r-- | fs/ext4/xattr.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 1846e9168f80..59c9ec7eabae 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -231,13 +231,12 @@ static int __xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *header, void *end, const char *function, unsigned int line) { - struct ext4_xattr_entry *entry = IFIRST(header); int error = -EFSCORRUPTED; - if (((void *) header >= end) || + if (end - (void *)header < sizeof(*header) + sizeof(u32) || (header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC))) goto errout; - error = ext4_xattr_check_names(entry, end, entry); + error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header)); errout: if (error) __ext4_error_inode(inode, function, line, 0, |