[PATCH v2 2/2] ocfs2: reject inconsistent xattr bucket during defrag

[Joseph Qi]

ocfs2_defrag_xattr_bucket() has two mlog_bug_on_msg() checks that
assume the name/value pairs in a bucket are disjoint and that
xh_free_start is not below the compacted region.

ocfs2_validate_xattr_bucket() only checks each entry in isolation,
so a corrupt bucket holding overlapping entries, or one with an
inflated xh_free_start, passes validation and then hits BUG() in
defrag when a setxattr triggers it.

Defrag works on a linear copy of the bucket and does not touch the
real blocks before the copy back, so the checks can return an error
instead of calling BUG().

Fixes: 012255961c9e ("ocfs2: Enable xattr set in index btree")
Signed-off-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx>
---
 fs/ocfs2/xattr.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index c71fa7983b73..e6c49adaac8a 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -4804,16 +4804,22 @@ static int ocfs2_defrag_xattr_bucket(struct inode *inode,
 			memmove(bucket_buf + end - len,
 				bucket_buf + offset, len);
 			xe->xe_name_offset = cpu_to_le16(end - len);
+		} else if (end < offset + len) {
+			ret = ocfs2_error(inode->i_sb,
+					  "Defrag check failed for bucket %llu\n",
+					  (unsigned long long)blkno);
+			goto out;
 		}
 
-		mlog_bug_on_msg(end < offset + len, "Defrag check failed for "
-				"bucket %llu\n", (unsigned long long)blkno);
-
 		end -= len;
 	}
 
-	mlog_bug_on_msg(xh_free_start > end, "Defrag check failed for "
-			"bucket %llu\n", (unsigned long long)blkno);
+	if (xh_free_start > end) {
+		ret = ocfs2_error(inode->i_sb,
+				  "Defrag check failed for bucket %llu\n",
+				  (unsigned long long)blkno);
+		goto out;
+	}
 
 	if (xh_free_start == end)
 		goto out;
-- 
2.39.3