diff options
| author | Darrick J. Wong <djwong@kernel.org> | 2024-04-15 14:54:37 -0700 |
|---|---|---|
| committer | Darrick J. Wong <djwong@kernel.org> | 2024-04-15 14:58:51 -0700 |
| commit | 8c25dc728bd1ca9344001aa6ef4556885572baa4 (patch) | |
| tree | 8fbc84687c45a7520b21f191464fb9c83991e1c3 /fs/xfs/libxfs/xfs_attr_remote.c | |
| parent | f4887fbc41dcb1560ec5da982ac7c6ad04b71de5 (diff) | |
| download | linux-8c25dc728bd1ca9344001aa6ef4556885572baa4.tar.gz linux-8c25dc728bd1ca9344001aa6ef4556885572baa4.tar.bz2 linux-8c25dc728bd1ca9344001aa6ef4556885572baa4.zip | |
xfs: validate attr remote value buffer owners
Check the owner field of xattr remote value blocks.
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Diffstat (limited to 'fs/xfs/libxfs/xfs_attr_remote.c')
| -rw-r--r-- | fs/xfs/libxfs/xfs_attr_remote.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/fs/xfs/libxfs/xfs_attr_remote.c b/fs/xfs/libxfs/xfs_attr_remote.c index 024895cc7029..a8de9dc1e998 100644 --- a/fs/xfs/libxfs/xfs_attr_remote.c +++ b/fs/xfs/libxfs/xfs_attr_remote.c @@ -280,12 +280,12 @@ xfs_attr_rmtval_copyout( struct xfs_mount *mp, struct xfs_buf *bp, struct xfs_inode *dp, + xfs_ino_t owner, int *offset, int *valuelen, uint8_t **dst) { char *src = bp->b_addr; - xfs_ino_t ino = dp->i_ino; xfs_daddr_t bno = xfs_buf_daddr(bp); int len = BBTOB(bp->b_length); int blksize = mp->m_attr_geo->blksize; @@ -299,11 +299,11 @@ xfs_attr_rmtval_copyout( byte_cnt = min(*valuelen, byte_cnt); if (xfs_has_crc(mp)) { - if (xfs_attr3_rmt_hdr_ok(src, ino, *offset, + if (xfs_attr3_rmt_hdr_ok(src, owner, *offset, byte_cnt, bno)) { xfs_alert(mp, "remote attribute header mismatch bno/off/len/owner (0x%llx/0x%x/Ox%x/0x%llx)", - bno, *offset, byte_cnt, ino); + bno, *offset, byte_cnt, owner); xfs_dirattr_mark_sick(dp, XFS_ATTR_FORK); return -EFSCORRUPTED; } @@ -427,8 +427,7 @@ xfs_attr_rmtval_get( return error; error = xfs_attr_rmtval_copyout(mp, bp, args->dp, - &offset, &valuelen, - &dst); + args->owner, &offset, &valuelen, &dst); xfs_buf_relse(bp); if (error) return error; |