diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index 1b094a4f3866..d6541e661dfa 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -1614,9 +1614,19 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir, if (ext4_get_inline_size(dir) == EXT4_MIN_INLINE_DATA_SIZE) goto out; - + inline_start = ext4_get_inline_xattr_pos(dir, &is.iloc); inline_size = ext4_get_inline_size(dir) - EXT4_MIN_INLINE_DATA_SIZE; + void *inode_start = ext4_raw_inode(&is.iloc); + void *inode_end = inode_start + EXT4_INODE_SIZE(dir->i_sb); + + if (inline_start < inode_start || + inline_start >= inode_end || + inline_start + inline_size > inode_end) { + printk(KERN_WARNING "found error in ext4_find_inline_entry\n"); + ret = -EFSCORRUPTED; + goto out; + } ret = ext4_search_dir(is.iloc.bh, inline_start, inline_size, dir, fname, 0, res_dir);