xfs_attr_node_list_lookup() walks the attribute dabtree with the on-disk node count and indexes btree[] without a fork-specific geometry check. The node verifier only bounds the count against the larger of the directory and attribute geometries, so a crafted attr node can pass verification with more entries than its buffer holds. Reject counts above mp->m_attr_geo->node_ents before the btree[] walk. Use the existing corruption and sick reporting path. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Shengzhuo Wei --- fs/xfs/xfs_attr_list.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c index f751edb930b6..667740e37c83 100644 --- a/fs/xfs/xfs_attr_list.c +++ b/fs/xfs/xfs_attr_list.c @@ -258,6 +258,9 @@ xfs_attr_node_list_lookup( if (nodehdr.level >= XFS_DA_NODE_MAXDEPTH) goto out_corruptbuf; + if (nodehdr.count > mp->m_attr_geo->node_ents) + goto out_corruptbuf; + /* Check the level from the root node. */ if (cursor->blkno == 0) expected_level = nodehdr.level - 1; -- 2.47.3