[PATCH v2 2/5] ubifs: reject xattr inodes whose size does not match the value

[shao.mingyin]

v2: merge the new size check into the existing ui->xattr block, as
    suggested by Zhihao Cheng.

diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 38972786817e..d89dd76a6847 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -88,8 +88,22 @@ static int validate_inode(struct ubifs_info *c, const struct inode *inode)
 	if (ui->data_len < 0 || ui->data_len > UBIFS_MAX_INO_DATA)
 		return 4;
 
-	if (ui->xattr && !S_ISREG(inode->i_mode))
-		return 5;
+	if (ui->xattr) {
+		if (!S_ISREG(inode->i_mode))
+			return 5;
+
+		/*
+		 * Extended attribute inodes keep the value in the inode node
+		 * and maintain i_size == data_len everywhere (see
+		 * create_xattr() and change_xattr()).
+		 */
+		if (inode->i_size != ui->data_len) {
+			ubifs_err(c, "xattr inode %llu has size %lld, but %d bytes of data",
+				  inode->i_ino, (long long)inode->i_size,
+				  ui->data_len);
+			return 6;
+		}
+	}
 
 	if (!ubifs_compr_present(c, ui->compr_type)) {
 		ubifs_warn(c, "inode %llu uses '%s' compression, but it was not compiled in",