| From fa8b18edd752a8b4e9d1ee2cd615b82c93cf8bba Mon Sep 17 00:00:00 2001 |
| From: Christoph Hellwig <hch@infradead.org> |
| Date: Sun, 20 Nov 2011 15:35:32 +0000 |
| Subject: xfs: validate acl count |
| |
| From: Christoph Hellwig <hch@infradead.org> |
| |
| commit fa8b18edd752a8b4e9d1ee2cd615b82c93cf8bba upstream. |
| |
| This prevents in-memory corruption and possible panics if the on-disk |
| ACL is badly corrupted. |
| |
| Signed-off-by: Christoph Hellwig <hch@lst.de> |
| Signed-off-by: Ben Myers <bpm@sgi.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| fs/xfs/xfs_acl.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/fs/xfs/xfs_acl.c |
| +++ b/fs/xfs/xfs_acl.c |
| @@ -42,6 +42,8 @@ xfs_acl_from_disk(struct xfs_acl *aclp) |
| int count, i; |
| |
| count = be32_to_cpu(aclp->acl_cnt); |
| + if (count > XFS_ACL_MAX_ENTRIES) |
| + return ERR_PTR(-EFSCORRUPTED); |
| |
| acl = posix_acl_alloc(count, GFP_KERNEL); |
| if (!acl) |
