On May 13, 2019, at 4:40 PM, Chengguang Xu <cgxu519@xxxxxxxxxxx> wrote:
>
> Introduce helper function ext2_xattr_entry_valid()
> for xattr entry validation and clean up the entry
> check ralated code.
>
> Signed-off-by: Chengguang Xu <cgxu519@xxxxxxxxxxx>
Reviewed-by: Andreas Dilger <adilger@xxxxxxxxx>
> ---
> v1->v2:
> - Pass end offset instead of inode to ext2_xattr_entry_valid()
> - Change signed-off mail address.
>
> fs/ext2/xattr.c | 21 +++++++++++++++++----
> 1 file changed, 17 insertions(+), 4 deletions(-)
>
> diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
> index db27260d6a5b..d11c83529514 100644
> --- a/fs/ext2/xattr.c
> +++ b/fs/ext2/xattr.c
> @@ -144,6 +144,20 @@ ext2_xattr_header_valid(struct ext2_xattr_header *header)
> return true;
> }
>
> +static bool
> +ext2_xattr_entry_valid(struct ext2_xattr_entry *entry, size_t size,
> + size_t end_offs)
> +{
> + if (entry->e_value_block != 0)
> + return false;
> +
> + if (size > end_offs ||
> + le16_to_cpu(entry->e_value_offs) + size > end_offs)
> + return false;
> +
> + return true;
> +}
> +
> /*
> * ext2_xattr_get()
> *
> @@ -217,8 +231,7 @@ ext2_xattr_get(struct inode *inode, int name_index, const char *name,
> if (entry->e_value_block != 0)
> goto bad_block;
> size = le32_to_cpu(entry->e_value_size);
> - if (size > inode->i_sb->s_blocksize ||
> - le16_to_cpu(entry->e_value_offs) + size > inode->i_sb->s_blocksize)
> + if (!ext2_xattr_entry_valid(entry, size, inode->i_sb->s_blocksize))
> goto bad_block;
>
> if (ext2_xattr_cache_insert(ea_block_cache, bh))
> @@ -483,8 +496,8 @@ ext2_xattr_set(struct inode *inode, int name_index, const char *name,
> if (!here->e_value_block && here->e_value_size) {
> size_t size = le32_to_cpu(here->e_value_size);
>
> - if (le16_to_cpu(here->e_value_offs) + size >
> - sb->s_blocksize || size > sb->s_blocksize)
> + if (!ext2_xattr_entry_valid(here, size,
> + inode->i_sb->s_blocksize))
> goto bad_block;
> free += EXT2_XATTR_SIZE(size);
> }
> --
> 2.17.2
>
>
Cheers, Andreas
Attachment:
signature.asc
Description: Message signed with OpenPGP
