diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index d70a20d29e3e..3d21f2b9966e 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -470,7 +470,23 @@ static int ocfs2_validate_xattr_block(struct super_block *sb, trace_ocfs2_validate_xattr_block((unsigned long long)bh->b_blocknr); BUG_ON(!buffer_uptodate(bh)); - + if (!(le16_to_cpu(xb->xb_flags) & OCFS2_XATTR_INDEXED)) { + struct ocfs2_xattr_header *header = &xb->xb_attrs.xb_header; + u16 xattr_count; + size_t max_entries; + + xattr_count = le16_to_cpu(header->xh_count); + max_entries = (sb->s_blocksize - + offsetof(struct ocfs2_xattr_block, xb_attrs.xb_header) - + sizeof(struct ocfs2_xattr_header)) / + sizeof(struct ocfs2_xattr_entry); + if (xattr_count > max_entries) { + return ocfs2_error(sb, + "Extended attribute block #%llu has invalid xattr count %u (max %zu)\n", + (unsigned long long)bh->b_blocknr, + xattr_count, max_entries); + } + } /* * If the ecc fails, we return the error but otherwise * leave the filesystem running. We know any error is