ext4: check EA value offset when loading
authorDarrick J. Wong <darrick.wong@oracle.com>
Tue, 16 Sep 2014 18:34:59 +0000 (14:34 -0400)
committerTheodore Ts'o <tytso@mit.edu>
Tue, 16 Sep 2014 18:34:59 +0000 (14:34 -0400)
commita0626e75954078cfacddb00a4545dde821170bc5
tree61aeb6747c5fc7016ac54cc704fb6d9b1833674d
parent684de5748660e16e185754697ac0afa9e18297f6
ext4: check EA value offset when loading

When loading extended attributes, check each entry's value offset to
make sure it doesn't collide with the entries.

Without this check it is easy to crash the kernel by mounting a
malicious FS containing a file with an EA wherein e_value_offs = 0 and
e_value_size > 0 and then deleting the EA, which corrupts the name
list.

(See the f_ea_value_crash test's FS image in e2fsprogs for an example.)

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
fs/ext4/xattr.c