summaryrefslogtreecommitdiffstats
path: root/fs/ext2
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2019-05-15 15:39:42 +0200
committerJan Kara <jack@suse.cz>2019-05-20 10:50:48 +0200
commit6c71b489ecfd927966571348f4e4135169a9fbd5 (patch)
treec032d4200b8022641cea1d5c19e616545c24cd5f /fs/ext2
parent8cd0f2ba787a1a1758dbe063fe6a26ceccd37c24 (diff)
downloadlinux-6c71b489ecfd927966571348f4e4135169a9fbd5.tar.bz2
ext2: Strengthen xattr block checks
Check every entry in xattr block for validity in ext2_xattr_set() to detect on disk corruption early. Also since e_value_block field in xattr entry is never != 0 in a valid filesystem, just remove checks for it once we have established entries are valid. Reviewed-by: Chengguang Xu <cgxu519@zoho.com.cn> Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/ext2')
-rw-r--r--fs/ext2/xattr.c22
1 files changed, 10 insertions, 12 deletions
diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
index f9fda6d16d78..d21dbf297b74 100644
--- a/fs/ext2/xattr.c
+++ b/fs/ext2/xattr.c
@@ -218,6 +218,8 @@ bad_block:
EXT2_XATTR_NEXT(entry);
if ((char *)next >= end)
goto bad_block;
+ if (!ext2_xattr_entry_valid(entry, inode->i_sb->s_blocksize))
+ goto bad_block;
if (name_index == entry->e_name_index &&
name_len == entry->e_name_len &&
memcmp(name, entry->e_name, name_len) == 0)
@@ -229,9 +231,6 @@ bad_block:
error = -ENODATA;
goto cleanup;
found:
- if (!ext2_xattr_entry_valid(entry, inode->i_sb->s_blocksize))
- goto bad_block;
-
size = le32_to_cpu(entry->e_value_size);
if (ext2_xattr_cache_insert(ea_block_cache, bh))
ea_idebug(inode, "cache insert failed");
@@ -304,6 +303,8 @@ bad_block:
if ((char *)next >= end)
goto bad_block;
+ if (!ext2_xattr_entry_valid(entry, inode->i_sb->s_blocksize))
+ goto bad_block;
entry = next;
}
if (ext2_xattr_cache_insert(ea_block_cache, bh))
@@ -446,7 +447,9 @@ bad_block:
struct ext2_xattr_entry *next = EXT2_XATTR_NEXT(last);
if ((char *)next >= end)
goto bad_block;
- if (!last->e_value_block && last->e_value_size) {
+ if (!ext2_xattr_entry_valid(last, sb->s_blocksize))
+ goto bad_block;
+ if (last->e_value_size) {
size_t offs = le16_to_cpu(last->e_value_offs);
if (offs < min_offs)
min_offs = offs;
@@ -489,12 +492,7 @@ bad_block:
error = -EEXIST;
if (flags & XATTR_CREATE)
goto cleanup;
- if (!here->e_value_block && here->e_value_size) {
- if (!ext2_xattr_entry_valid(here, sb->s_blocksize))
- goto bad_block;
- free += EXT2_XATTR_SIZE(
- le32_to_cpu(here->e_value_size));
- }
+ free += EXT2_XATTR_SIZE(le32_to_cpu(here->e_value_size));
free += EXT2_XATTR_LEN(name_len);
}
error = -ENOSPC;
@@ -559,7 +557,7 @@ bad_block:
here->e_name_len = name_len;
memcpy(here->e_name, name, name_len);
} else {
- if (!here->e_value_block && here->e_value_size) {
+ if (here->e_value_size) {
char *first_val = (char *)header + min_offs;
size_t offs = le16_to_cpu(here->e_value_offs);
char *val = (char *)header + offs;
@@ -586,7 +584,7 @@ bad_block:
last = ENTRY(header+1);
while (!IS_LAST_ENTRY(last)) {
size_t o = le16_to_cpu(last->e_value_offs);
- if (!last->e_value_block && o < offs)
+ if (o < offs)
last->e_value_offs =
cpu_to_le16(o + size);
last = EXT2_XATTR_NEXT(last);