xfs: validate attr remote value buffer owners

Check the owner field of xattr remote value blocks.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>

diff --git a/fs/xfs/libxfs/xfs_attr_remote.c b/fs/xfs/libxfs/xfs_attr_remote.c
index 024895cc702995763476f62e80c279b42038f7e8..a8de9dc1e998a338917153ce3a0b3dccbefc7779 100644 (file)
--- a/fs/xfs/libxfs/xfs_attr_remote.c
+++ b/fs/xfs/libxfs/xfs_attr_remote.c
@@ -280,12 +280,12 @@ xfs_attr_rmtval_copyout(
        struct xfs_mount        *mp,
        struct xfs_buf          *bp,
        struct xfs_inode        *dp,
+       xfs_ino_t               owner,
        int                     *offset,
        int                     *valuelen,
        uint8_t                 **dst)
 {
        char                    *src = bp->b_addr;
-       xfs_ino_t               ino = dp->i_ino;
        xfs_daddr_t             bno = xfs_buf_daddr(bp);
        int                     len = BBTOB(bp->b_length);
        int                     blksize = mp->m_attr_geo->blksize;
@@ -299,11 +299,11 @@ xfs_attr_rmtval_copyout(
                byte_cnt = min(*valuelen, byte_cnt);
 
                if (xfs_has_crc(mp)) {
-                       if (xfs_attr3_rmt_hdr_ok(src, ino, *offset,
+                       if (xfs_attr3_rmt_hdr_ok(src, owner, *offset,
                                                  byte_cnt, bno)) {
                                xfs_alert(mp,
 "remote attribute header mismatch bno/off/len/owner (0x%llx/0x%x/Ox%x/0x%llx)",
-                                       bno, *offset, byte_cnt, ino);
+                                       bno, *offset, byte_cnt, owner);
                                xfs_dirattr_mark_sick(dp, XFS_ATTR_FORK);
                                return -EFSCORRUPTED;
                        }
@@ -427,8 +427,7 @@ xfs_attr_rmtval_get(
                                return error;
 
                        error = xfs_attr_rmtval_copyout(mp, bp, args->dp,
-                                                       &offset, &valuelen,
-                                                       &dst);
+                                       args->owner, &offset, &valuelen, &dst);
                        xfs_buf_relse(bp);
                        if (error)
                                return error;