[PATCH 2/5] ubifs: reject xattr inodes whose size does not match the value

[shao.mingyin]

An extended attribute inode stores the value in the inode node and
UBIFS keeps inode->i_size equal to ubifs_inode->data_len (see
create_xattr() and change_xattr()).  validate_inode() does not check
this for inodes that carry UBIFS_XATTR_FL, so an image with a mismatch
is accepted.  ubifs_xattr_get() and remove_xattr() then trip their
ubifs_assert() on the invariant; with the assert=read-only or
assert=panic mount option a plain getxattr() or removexattr() turns the
file system read-only or panics the kernel.

Reject such inodes at iget time.

Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 38972786817e..9f608c10b39e 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -91,6 +91,18 @@ static int validate_inode(struct ubifs_info *c, const struct inode *inode)
 	if (ui->xattr && !S_ISREG(inode->i_mode))
 		return 5;
 
+	/*
+	 * Extended attribute inodes keep the value in the inode node and
+	 * maintain i_size == data_len everywhere (see create_xattr() and
+	 * change_xattr()).
+	 */
+	if (ui->xattr && inode->i_size != ui->data_len) {
+		ubifs_err(c, "xattr inode %llu has size %lld, but %d bytes of data",
+			  inode->i_ino, (long long)inode->i_size,
+			  ui->data_len);
+		return 6;
+	}
+
 	if (!ubifs_compr_present(c, ui->compr_type)) {
 		ubifs_warn(c, "inode %llu uses '%s' compression, but it was not compiled in",
 			   inode->i_ino, ubifs_compr_name(c, ui->compr_type));