xfs: fail out of xfs_attr3_leaf_lookup_int if it looks corrupt

Source kernel commit: 8ba92d43d499f4920af983a7c16e02304dd36932

If the xattr leaf block looks corrupt, return -EFSCORRUPTED to userspace
instead of ASSERTing on debug kernels or running off the end of the
buffer on regular kernels.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>

diff --git a/libxfs/xfs_attr_leaf.c b/libxfs/xfs_attr_leaf.c
index 2e8fb13dd45ddf3e4b588861076c5eac2a122afa..9c11a0c37e8b38096d64b8bc3975cd99f6344e5e 100644 (file)
--- a/libxfs/xfs_attr_leaf.c
+++ b/libxfs/xfs_attr_leaf.c
@@ -2244,7 +2244,8 @@ xfs_attr3_leaf_lookup_int(
        leaf = bp->b_addr;
        xfs_attr3_leaf_hdr_from_disk(args->geo, &ichdr, leaf);
        entries = xfs_attr3_leaf_entryp(leaf);
-       ASSERT(ichdr.count < args->geo->blksize / 8);
+       if (ichdr.count >= args->geo->blksize / 8)
+               return -EFSCORRUPTED;
 
        /*
         * Binary search.  (note: small blocks will skip this loop)
@@ -2260,8 +2261,10 @@ xfs_attr3_leaf_lookup_int(
                else
                        break;
        }
-       ASSERT(probe >= 0 && (!ichdr.count || probe < ichdr.count));
-       ASSERT(span <= 4 || be32_to_cpu(entry->hashval) == hashval);
+       if (!(probe >= 0 && (!ichdr.count || probe < ichdr.count)))
+               return -EFSCORRUPTED;
+       if (!(span <= 4 || be32_to_cpu(entry->hashval) == hashval))
+               return -EFSCORRUPTED;
 
        /*
         * Since we may have duplicate hashval's, find the first matching