summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorEric Biggers <ebiggers@google.com>2016-12-01 14:51:58 -0500
committerTheodore Ts'o <tytso@mit.edu>2016-12-01 14:51:58 -0500
commit290ab230016f187c3551d8380ea742889276d03a (patch)
tree051138c85bb6f7d8ac52513ecfb510832cee9220 /fs
parent2dc8d9e19b0d891b0d3675b5ac82be9be3875e36 (diff)
ext4: don't read out of bounds when checking for in-inode xattrs
With i_extra_isize equal to or close to the available space, it was possible for us to read past the end of the inode when trying to detect or validate in-inode xattrs. Fix this by checking for the needed extra space first. This patch shouldn't have any noticeable effect on non-corrupted/non-malicious filesystems. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu> Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Diffstat (limited to 'fs')
-rw-r--r--fs/ext4/inode.c4
-rw-r--r--fs/ext4/xattr.c5
2 files changed, 5 insertions, 4 deletions
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index e3e197898c66..59a518ad6bb2 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4527,7 +4527,9 @@ static inline void ext4_iget_extra_inode(struct inode *inode,
{
__le32 *magic = (void *)raw_inode +
EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize;
- if (*magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
+ if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32) <=
+ EXT4_INODE_SIZE(inode->i_sb) &&
+ *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) {
ext4_set_inode_state(inode, EXT4_STATE_XATTR);
ext4_find_inline_data_nolock(inode);
} else
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 1846e9168f80..59c9ec7eabae 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -231,13 +231,12 @@ static int
__xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *header,
void *end, const char *function, unsigned int line)
{
- struct ext4_xattr_entry *entry = IFIRST(header);
int error = -EFSCORRUPTED;
- if (((void *) header >= end) ||
+ if (end - (void *)header < sizeof(*header) + sizeof(u32) ||
(header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)))
goto errout;
- error = ext4_xattr_check_names(entry, end, entry);
+ error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header));
errout:
if (error)
__ext4_error_inode(inode, function, line, 0,