From: Dave Chinner <dchinner@xxxxxxxxxx> Source kernel commit: 59e43f5479cce106d71c0b91a297c7ad1913176c It's just read in from the superblock and used without doing any validity checks at all on the value. Fixes: fb4f2b4e5a82 ("xfs: add sparse inode chunk alignment superblock field") Signed-off-by: Dave Chinner <dchinner@xxxxxxxxxx> Reviewed-by: Darrick J. Wong <djwong@xxxxxxxxxx> Signed-off-by: Carlos Maiolino <cem@xxxxxxxxxx> --- libxfs/xfs_sb.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/libxfs/xfs_sb.c b/libxfs/xfs_sb.c index 0603e5087f2e46..0d98b8a344209e 100644 --- a/libxfs/xfs_sb.c +++ b/libxfs/xfs_sb.c @@ -395,6 +395,20 @@ xfs_validate_sb_common( sbp->sb_inoalignmt, align); return -EINVAL; } + + if (!sbp->sb_spino_align || + sbp->sb_spino_align > sbp->sb_inoalignmt || + (sbp->sb_inoalignmt % sbp->sb_spino_align) != 0) { + xfs_warn(mp, + "Sparse inode alignment (%u) is invalid.", + sbp->sb_spino_align); + return -EINVAL; + } + } else if (sbp->sb_spino_align) { + xfs_warn(mp, + "Sparse inode alignment (%u) should be zero.", + sbp->sb_spino_align); + return -EINVAL; } } else if (sbp->sb_qflags & (XFS_PQUOTA_ENFD | XFS_GQUOTA_ENFD | XFS_PQUOTA_CHKD | XFS_GQUOTA_CHKD)) {