Commit 8c25dc72 authored by Darrick J. Wong's avatar Darrick J. Wong
Browse files

xfs: validate attr remote value buffer owners 



Check the owner field of xattr remote value blocks.

Signed-off-by: default avatarDarrick J. Wong <djwong@kernel.org>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
parent f4887fbc

fs/xfs/libxfs/xfs_attr_remote.c

+4 −5
Original line number Diff line number Diff line
@@ -280,12 +280,12 @@ xfs_attr_rmtval_copyout( 
	struct xfs_mount	*mp,

	struct xfs_buf		*bp,

	struct xfs_inode	*dp,

	xfs_ino_t		owner,

	int			*offset,

	int			*valuelen,

	uint8_t			**dst)

{

	char			*src = bp->b_addr;

	xfs_ino_t		ino = dp->i_ino;

	xfs_daddr_t		bno = xfs_buf_daddr(bp);

	int			len = BBTOB(bp->b_length);

	int			blksize = mp->m_attr_geo->blksize;
@@ -299,11 +299,11 @@ xfs_attr_rmtval_copyout( 
		byte_cnt = min(*valuelen, byte_cnt);



		if (xfs_has_crc(mp)) {

			if (xfs_attr3_rmt_hdr_ok(src, ino, *offset,

			if (xfs_attr3_rmt_hdr_ok(src, owner, *offset,

						  byte_cnt, bno)) {

				xfs_alert(mp,

"remote attribute header mismatch bno/off/len/owner (0x%llx/0x%x/Ox%x/0x%llx)",

					bno, *offset, byte_cnt, ino);

					bno, *offset, byte_cnt, owner);

				xfs_dirattr_mark_sick(dp, XFS_ATTR_FORK);

				return -EFSCORRUPTED;

			}
@@ -427,8 +427,7 @@ xfs_attr_rmtval_get( 
				return error;



			error = xfs_attr_rmtval_copyout(mp, bp, args->dp,

							&offset, &valuelen,

							&dst);

					args->owner, &offset, &valuelen, &dst);

			xfs_buf_relse(bp);

			if (error)

				return error;