Commit f4c3fb8c authored by Chengguang Xu's avatar Chengguang Xu Committed by Jan Kara

ext2: introduce helper for xattr entry validation

Introduce helper function ext2_xattr_entry_valid()
for xattr entry validation and clean up the entry
check related code.
Reviewed-by: default avatarAndreas Dilger <adilger@dilger.ca>
Signed-off-by: default avatarChengguang Xu <cgxu519@zoho.com.cn>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent 02475de9
...@@ -144,6 +144,22 @@ ext2_xattr_header_valid(struct ext2_xattr_header *header) ...@@ -144,6 +144,22 @@ ext2_xattr_header_valid(struct ext2_xattr_header *header)
return true; return true;
} }
static bool
ext2_xattr_entry_valid(struct ext2_xattr_entry *entry, size_t end_offs)
{
size_t size;
if (entry->e_value_block != 0)
return false;
size = le32_to_cpu(entry->e_value_size);
if (size > end_offs ||
le16_to_cpu(entry->e_value_offs) + size > end_offs)
return false;
return true;
}
/* /*
* ext2_xattr_get() * ext2_xattr_get()
* *
...@@ -213,14 +229,10 @@ ext2_xattr_get(struct inode *inode, int name_index, const char *name, ...@@ -213,14 +229,10 @@ ext2_xattr_get(struct inode *inode, int name_index, const char *name,
error = -ENODATA; error = -ENODATA;
goto cleanup; goto cleanup;
found: found:
/* check the buffer size */ if (!ext2_xattr_entry_valid(entry, inode->i_sb->s_blocksize))
if (entry->e_value_block != 0)
goto bad_block;
size = le32_to_cpu(entry->e_value_size);
if (size > inode->i_sb->s_blocksize ||
le16_to_cpu(entry->e_value_offs) + size > inode->i_sb->s_blocksize)
goto bad_block; goto bad_block;
size = le32_to_cpu(entry->e_value_size);
if (ext2_xattr_cache_insert(ea_block_cache, bh)) if (ext2_xattr_cache_insert(ea_block_cache, bh))
ea_idebug(inode, "cache insert failed"); ea_idebug(inode, "cache insert failed");
if (buffer) { if (buffer) {
...@@ -481,12 +493,10 @@ ext2_xattr_set(struct inode *inode, int name_index, const char *name, ...@@ -481,12 +493,10 @@ ext2_xattr_set(struct inode *inode, int name_index, const char *name,
if (flags & XATTR_CREATE) if (flags & XATTR_CREATE)
goto cleanup; goto cleanup;
if (!here->e_value_block && here->e_value_size) { if (!here->e_value_block && here->e_value_size) {
size_t size = le32_to_cpu(here->e_value_size); if (!ext2_xattr_entry_valid(here, sb->s_blocksize))
if (le16_to_cpu(here->e_value_offs) + size >
sb->s_blocksize || size > sb->s_blocksize)
goto bad_block; goto bad_block;
free += EXT2_XATTR_SIZE(size); free += EXT2_XATTR_SIZE(
le32_to_cpu(here->e_value_size));
} }
free += EXT2_XATTR_LEN(name_len); free += EXT2_XATTR_LEN(name_len);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment