From: Chengguang Xu cgxu519@zoho.com.cn
mainline inclusion from mainline-5.3-rc1 commit f4c3fb8c433f1818da46b720754a5d4a8525fdf0 category: bugfix bugzilla: 174001 CVE: NA
-------------------------------------------------
Introduce helper function ext2_xattr_entry_valid() for xattr entry validation and clean up the entry check related code.
Reviewed-by: Andreas Dilger adilger@dilger.ca Signed-off-by: Chengguang Xu cgxu519@zoho.com.cn Signed-off-by: Jan Kara jack@suse.cz
Conflicts: fs/ext2/xattr.c
Signed-off-by: Baokun Li libaokun1@huawei.com Reviewed-by: Zhang Yi yi.zhang@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- fs/ext2/xattr.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-)
diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c index bd1d68ff3a9f8..41988fb2fb8fc 100644 --- a/fs/ext2/xattr.c +++ b/fs/ext2/xattr.c @@ -135,6 +135,22 @@ ext2_xattr_handler(int name_index) return handler; }
+static bool +ext2_xattr_entry_valid(struct ext2_xattr_entry *entry, size_t end_offs) +{ + size_t size; + + if (entry->e_value_block != 0) + return false; + + size = le32_to_cpu(entry->e_value_size); + if (size > end_offs || + le16_to_cpu(entry->e_value_offs) + size > end_offs) + return false; + + return true; +} + /* * ext2_xattr_get() * @@ -204,14 +220,10 @@ bad_block: ext2_error(inode->i_sb, "ext2_xattr_get", error = -ENODATA; goto cleanup; found: - /* check the buffer size */ - if (entry->e_value_block != 0) - goto bad_block; - size = le32_to_cpu(entry->e_value_size); - if (size > inode->i_sb->s_blocksize || - le16_to_cpu(entry->e_value_offs) + size > inode->i_sb->s_blocksize) + if (!ext2_xattr_entry_valid(entry, inode->i_sb->s_blocksize)) goto bad_block;
+ size = le32_to_cpu(entry->e_value_size); if (ext2_xattr_cache_insert(ea_block_cache, bh)) ea_idebug(inode, "cache insert failed"); if (buffer) { @@ -471,12 +483,10 @@ bad_block: ext2_error(sb, "ext2_xattr_set", if (flags & XATTR_CREATE) goto cleanup; if (!here->e_value_block && here->e_value_size) { - size_t size = le32_to_cpu(here->e_value_size); - - if (le16_to_cpu(here->e_value_offs) + size > - sb->s_blocksize || size > sb->s_blocksize) + if (!ext2_xattr_entry_valid(here, sb->s_blocksize)) goto bad_block; - free += EXT2_XATTR_SIZE(size); + free += EXT2_XATTR_SIZE( + le32_to_cpu(here->e_value_size)); } free += EXT2_XATTR_LEN(name_len); }