[PATCH] ocfs2: validate xattr bucket count against extent size

[Jiale Yao]

The first xattr bucket stores the number of valid buckets in its extent.
Lookup and iteration trust this on-disk value even when it exceeds the
number of buckets covered by the extent record. A corrupted value can
therefore make them read blocks beyond the extent.

Validate the count against the extent cluster count before using it.
Reject zero as well because every xattr extent contains at least its first
bucket.

Fixes: 589dc2602f2a ("ocfs2: Add xattr lookup code xattr btrees")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 fs/ocfs2/xattr.c | 31 +++++++++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index b2bd06083a14..6b2fc8337c51 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -328,6 +328,22 @@ static inline u16 ocfs2_blocks_per_xattr_bucket(struct super_block *sb)
 	return OCFS2_XATTR_BUCKET_SIZE / (1 << sb->s_blocksize_bits);
 }
 
+static int ocfs2_validate_xattr_bucket_count(struct inode *inode,
+					     struct ocfs2_xattr_header *xh,
+					     u32 num_clusters)
+{
+	u32 num_buckets = le16_to_cpu(xh->xh_num_buckets);
+	u32 max_buckets = num_clusters *
+		ocfs2_xattr_buckets_per_cluster(OCFS2_SB(inode->i_sb));
+
+	if (!num_buckets || num_buckets > max_buckets)
+		return ocfs2_error(inode->i_sb,
+				   "Inode %llu has invalid xattr bucket count %u (max %u)\n",
+				   inode->i_ino, num_buckets, max_buckets);
+
+	return 0;
+}
+
 #define bucket_blkno(_b) ((_b)->bu_bhs[0]->b_blocknr)
 #define bucket_block(_b, _n) ((_b)->bu_bhs[(_n)]->b_data)
 #define bucket_xh(_b) ((struct ocfs2_xattr_header *)bucket_block((_b), 0))
@@ -4295,6 +4311,10 @@ static int ocfs2_xattr_bucket_find(struct inode *inode,
 	}
 
 	xh = bucket_xh(search);
+	ret = ocfs2_validate_xattr_bucket_count(inode, xh, num_clusters);
+	if (ret)
+		goto out;
+
 	high_bucket = le16_to_cpu(xh->xh_num_buckets) - 1;
 	while (low_bucket <= high_bucket) {
 		ocfs2_xattr_bucket_relse(search);
@@ -4480,6 +4500,7 @@ static int ocfs2_iterate_xattr_buckets(struct inode *inode,
 	int i, ret = 0;
 	u32 bpc = ocfs2_xattr_buckets_per_cluster(OCFS2_SB(inode->i_sb));
 	u32 num_buckets = clusters * bpc;
+	struct ocfs2_xattr_header *xh;
 	struct ocfs2_xattr_bucket *bucket;
 
 	bucket = ocfs2_xattr_bucket_new(inode);
@@ -4503,8 +4524,14 @@ static int ocfs2_iterate_xattr_buckets(struct inode *inode,
 		 * The real bucket num in this series of blocks is stored
 		 * in the 1st bucket.
 		 */
-		if (i == 0)
-			num_buckets = le16_to_cpu(bucket_xh(bucket)->xh_num_buckets);
+		if (i == 0) {
+			xh = bucket_xh(bucket);
+			ret = ocfs2_validate_xattr_bucket_count(inode, xh, clusters);
+			if (ret)
+				break;
+
+			num_buckets = le16_to_cpu(xh->xh_num_buckets);
+		}
 
 		trace_ocfs2_iterate_xattr_bucket((unsigned long long)blkno,
 		     le32_to_cpu(bucket_xh(bucket)->xh_entries[0].xe_name_hash));
-- 
2.34.1