Commit 6a01f547 authored by Utkal Singh's avatar Utkal Singh Committed by Gao Xiang
Browse files

erofs: harden h_shared_count in erofs_init_inode_xattrs() 



`u8 h_shared_count` indicates the shared xattr count of an inode. It is
read from the on-disk xattr ibody header, which should be corrupted if
the size of the shared xattr array exceeds the space available in
`xattr_isize`.

It does not cause harmful consequence (e.g. crashes), since the image is
already considered corrupted, it indeed results in the silent processing
of garbage metadata.

Let's harden it to report -EFSCORRUPTED earlier.

Signed-off-by: default avatarUtkal Singh <singhutkal015@gmail.com>
Reviewed-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
Reviewed-by: default avatarChao Yu <chao@kernel.org>
Signed-off-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
parent 7aaa8047

fs/erofs/xattr.c

+8 −0
Original line number Diff line number Diff line
@@ -85,6 +85,14 @@ static int erofs_init_inode_xattrs(struct inode *inode) 
	}

	vi->xattr_name_filter = le32_to_cpu(ih->h_name_filter);

	vi->xattr_shared_count = ih->h_shared_count;

	if ((u32)vi->xattr_shared_count * sizeof(__le32) >

	    vi->xattr_isize - sizeof(struct erofs_xattr_ibody_header)) {

		erofs_err(sb, "invalid h_shared_count %u @ nid %llu",

			  vi->xattr_shared_count, vi->nid);

		erofs_put_metabuf(&buf);

		ret = -EFSCORRUPTED;

		goto out_unlock;

	}

	vi->xattr_shared_xattrs = kmalloc_objs(uint, vi->xattr_shared_count);

	if (!vi->xattr_shared_xattrs) {

		erofs_put_metabuf(&buf);