[PATCH] ocfs2: validate non-coherent freefrag bitmap inode

[Jiale Yao]

The non-coherent freefrag ioctl path reads the global bitmap inode
directly and trusts its chain list. A malformed cl_next_free_rec value
can therefore index beyond cl_recs while scanning chains.

Validate the inode block before consuming its bitmap and chain metadata.

Fixes: d24a10b9f8ed ("Ocfs2: Add a new code 'OCFS2_INFO_FREEFRAG' for o2info ioctl.")
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 fs/ocfs2/ioctl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
index cbe59d231666..8383f900c847 100644
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -575,6 +575,12 @@ static int ocfs2_info_freefrag_scan_bitmap(struct ocfs2_super *osb,
 			mlog_errno(status);
 			goto bail;
 		}
+
+		status = ocfs2_validate_inode_block(osb->sb, bh);
+		if (status < 0) {
+			mlog_errno(status);
+			goto bail;
+		}
 	}
 
 	gb_dinode = (struct ocfs2_dinode *)bh->b_data;
-- 
2.34.1