[lvc-project] [PATCH] ocfs2: add extra consistency check to ocfs2_dx_dir_lookup()

[Dmitry Antipov]

In 'ocfs2_dx_dir_lookup()', check whether an extent list length
of the directory indexing block matches the one configured via
the superblock parameters established at mount, thus preventing
an out-of-bounds accesses in 'ocfs2_dx_dir_lookup_rec()'.

Reported-by: syzbot+30b53487d00b4f7f0922 at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=30b53487d00b4f7f0922
Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
---
 fs/ocfs2/dir.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index 8c9c4825f984..ff632f1337b7 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -865,6 +865,13 @@ static int ocfs2_dx_dir_lookup(struct inode *inode,
 	u64 blkno;
 	u32 name_hash = hinfo->major_hash;
 
+	if (le16_to_cpu(el->l_count) !=
+	    ocfs2_extent_recs_per_dx_root(inode->i_sb)) {
+		ret = -EFSCORRUPTED;
+		mlog_errno(ret);
+		goto out;
+	}
+
 	ret = ocfs2_dx_dir_lookup_rec(inode, el, name_hash, &cpos, &blkno,
 				      &clen);
 	if (ret) {
-- 
2.51.0