[PATCH 1/3] xfs: bound node entries on path shifts

[Shengzhuo Wei]

The da-node verifier uses the larger of the directory and attribute
geometry limits, so an attribute node can pass verification with more
entries than its buffer holds.  xfs_da3_path_shift() can load such a node
without passing through the lookup path's geometry check, then index
btree[] beyond the buffer.

Bound the count against args->geo->node_ents before indexing the entries
and report filesystem corruption if it exceeds that limit.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shengzhuo Wei <me@xxxxxxxx>
---
 fs/xfs/libxfs/xfs_da_btree.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c
index faf88488265c..88788ece69c6 100644
--- a/fs/xfs/libxfs/xfs_da_btree.c
+++ b/fs/xfs/libxfs/xfs_da_btree.c
@@ -2242,6 +2242,11 @@ xfs_da3_path_shift(
 			xfs_da3_node_hdr_from_disk(dp->i_mount, &nodehdr,
 						   bp->b_addr);
 			btree = nodehdr.btree;
+			if (nodehdr.count > args->geo->node_ents) {
+				xfs_buf_mark_corrupt(blk->bp);
+				xfs_da_mark_sick(args);
+				return -EFSCORRUPTED;
+			}
 			blk->hashval = be32_to_cpu(btree[nodehdr.count - 1].hashval);
 			if (forward)
 				blk->index = 0;

-- 
2.47.3