diff options
| author | Eric Biggers | 2016-12-01 20:51:58 +0100 |
|---|---|---|
| committer | Theodore Ts'o | 2016-12-01 20:51:58 +0100 |
| commit | 290ab230016f187c3551d8380ea742889276d03a (patch) | |
| tree | 051138c85bb6f7d8ac52513ecfb510832cee9220 /fs/ext4/inode.c | |
| parent | ext4: forbid i_extra_isize not divisible by 4 (diff) | |
| download | kernel-qcow2-linux-290ab230016f187c3551d8380ea742889276d03a.tar.gz kernel-qcow2-linux-290ab230016f187c3551d8380ea742889276d03a.tar.xz kernel-qcow2-linux-290ab230016f187c3551d8380ea742889276d03a.zip | |
ext4: don't read out of bounds when checking for in-inode xattrs
With i_extra_isize equal to or close to the available space, it was
possible for us to read past the end of the inode when trying to detect
or validate in-inode xattrs. Fix this by checking for the needed extra
space first.
This patch shouldn't have any noticeable effect on
non-corrupted/non-malicious filesystems.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Diffstat (limited to 'fs/ext4/inode.c')
| -rw-r--r-- | fs/ext4/inode.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index e3e197898c66..59a518ad6bb2 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -4527,7 +4527,9 @@ static inline void ext4_iget_extra_inode(struct inode *inode, { __le32 *magic = (void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize; - if (*magic == cpu_to_le32(EXT4_XATTR_MAGIC)) { + if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32) <= + EXT4_INODE_SIZE(inode->i_sb) && + *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) { ext4_set_inode_state(inode, EXT4_STATE_XATTR); ext4_find_inline_data_nolock(inode); } else |