The da-node verifier uses the larger of the directory and attribute geometry limits, so an attribute node can pass verification with more entries than its buffer holds. xfs_da3_path_shift() can load such a node without passing through the lookup path's geometry check, then index btree[] beyond the buffer. Bound the count against args->geo->node_ents before indexing the entries and report filesystem corruption if it exceeds that limit. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Shengzhuo Wei --- fs/xfs/libxfs/xfs_da_btree.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c index faf88488265c..88788ece69c6 100644 --- a/fs/xfs/libxfs/xfs_da_btree.c +++ b/fs/xfs/libxfs/xfs_da_btree.c @@ -2242,6 +2242,11 @@ xfs_da3_path_shift( xfs_da3_node_hdr_from_disk(dp->i_mount, &nodehdr, bp->b_addr); btree = nodehdr.btree; + if (nodehdr.count > args->geo->node_ents) { + xfs_buf_mark_corrupt(blk->bp); + xfs_da_mark_sick(args); + return -EFSCORRUPTED; + } blk->hashval = be32_to_cpu(btree[nodehdr.count - 1].hashval); if (forward) blk->index = 0; -- 2.47.3