[PATCH 3/3] xfs: bound attr node entries in listxattr

[Shengzhuo Wei]

xfs_attr_node_list_lookup() walks the attribute dabtree with the
on-disk node count and indexes btree[] without a fork-specific
geometry check.  The node verifier only bounds the count against the
larger of the directory and attribute geometries, so a crafted attr
node can pass verification with more entries than its buffer holds.

Reject counts above mp->m_attr_geo->node_ents before the btree[] walk.
Use the existing corruption and sick reporting path.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shengzhuo Wei <me@xxxxxxxx>
---
 fs/xfs/xfs_attr_list.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c
index f751edb930b6..667740e37c83 100644
--- a/fs/xfs/xfs_attr_list.c
+++ b/fs/xfs/xfs_attr_list.c
@@ -258,6 +258,9 @@ xfs_attr_node_list_lookup(
 		if (nodehdr.level >= XFS_DA_NODE_MAXDEPTH)
 			goto out_corruptbuf;
 
+		if (nodehdr.count > mp->m_attr_geo->node_ents)
+			goto out_corruptbuf;
+
 		/* Check the level from the root node. */
 		if (cursor->blkno == 0)
 			expected_level = nodehdr.level - 1;

-- 
2.47.3