• Darrick J. Wong's avatar
    ext4: check EA value offset when loading · a0626e75
    Darrick J. Wong authored
    When loading extended attributes, check each entry's value offset to
    make sure it doesn't collide with the entries.
    
    Without this check it is easy to crash the kernel by mounting a
    malicious FS containing a file with an EA wherein e_value_offs = 0 and
    e_value_size > 0 and then deleting the EA, which corrupts the name
    list.
    
    (See the f_ea_value_crash test's FS image in e2fsprogs for an example.)
    Signed-off-by: default avatarDarrick J. Wong <darrick.wong@oracle.com>
    Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    Cc: stable@vger.kernel.org
    a0626e75
xattr.c 46.1 KB