Patch "ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b7f5fb33c1a8082e27f435d865b8e97f155d90e8
Author: Ferry Meng <mengferry@xxxxxxxxxxxxxxxxx>
Date:   Mon May 20 10:40:24 2024 +0800

    ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
    
    [ Upstream commit af77c4fc1871847b528d58b7fdafb4aa1f6a9262 ]
    
    xattr in ocfs2 maybe 'non-indexed', which saved with additional space
    requested.  It's better to check if the memory is out of bound before
    memcmp, although this possibility mainly comes from crafted poisonous
    images.
    
    Link: https://lkml.kernel.org/r/20240520024024.1976129-2-joseph.qi@xxxxxxxxxxxxxxxxx
    Signed-off-by: Ferry Meng <mengferry@xxxxxxxxxxxxxxxxx>
    Signed-off-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>
    Reported-by: lei lu <llfamsec@xxxxxxxxx>
    Reviewed-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>
    Cc: Changwei Ge <gechangwei@xxxxxxx>
    Cc: Gang He <ghe@xxxxxxxx>
    Cc: Joel Becker <jlbec@xxxxxxxxxxxx>
    Cc: Jun Piao <piaojun@xxxxxxxxxx>
    Cc: Junxiao Bi <junxiao.bi@xxxxxxxxxx>
    Cc: Mark Fasheh <mark@xxxxxxxxxx>
    Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 884e45d27564b..ea1cbdff76622 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -1072,7 +1072,7 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index,
 {
 	struct ocfs2_xattr_entry *entry;
 	size_t name_len;
-	int i, cmp = 1;
+	int i, name_offset, cmp = 1;
 
 	if (name == NULL)
 		return -EINVAL;
@@ -1087,10 +1087,15 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index,
 		cmp = name_index - ocfs2_xattr_get_type(entry);
 		if (!cmp)
 			cmp = name_len - entry->xe_name_len;
-		if (!cmp)
-			cmp = memcmp(name, (xs->base +
-				     le16_to_cpu(entry->xe_name_offset)),
-				     name_len);
+		if (!cmp) {
+			name_offset = le16_to_cpu(entry->xe_name_offset);
+			if ((xs->base + name_offset + name_len) > xs->end) {
+				ocfs2_error(inode->i_sb,
+					    "corrupted xattr entries");
+				return -EFSCORRUPTED;
+			}
+			cmp = memcmp(name, (xs->base + name_offset), name_len);
+		}
 		if (cmp == 0)
 			break;
 		entry += 1;