From 84a08a84d1dbbc589dff501f5e5ccb3b595f578c Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: May 17 2023 19:16:08 +0000
Subject: ext4: add bounds checking in get_max_inline_xattr_value_size()

(bsc#1012628).

---

diff --git a/patches.kernel.org/6.3.3-234-ext4-add-bounds-checking-in-get_max_inline_xatt.patch b/patches.kernel.org/6.3.3-234-ext4-add-bounds-checking-in-get_max_inline_xatt.patch
new file mode 100644
index 0000000..a7226f5
--- /dev/null
+++ b/patches.kernel.org/6.3.3-234-ext4-add-bounds-checking-in-get_max_inline_xatt.patch
@@ -0,0 +1,66 @@
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Fri, 12 May 2023 15:11:02 -0400
+Subject: [PATCH] ext4: add bounds checking in
+ get_max_inline_xattr_value_size()
+References: bsc#1012628
+Patch-mainline: 6.3.3
+Git-commit: 2220eaf90992c11d888fe771055d4de330385f01
+
+commit 2220eaf90992c11d888fe771055d4de330385f01 upstream.
+
+Normally the extended attributes in the inode body would have been
+checked when the inode is first opened, but if someone is writing to
+the block device while the file system is mounted, it's possible for
+the inode table to get corrupted.  Add bounds checking to avoid
+reading beyond the end of allocated memory if this happens.
+
+Reported-by: syzbot+1966db24521e5f6e23f7@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=1966db24521e5f6e23f7
+Cc: stable@kernel.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/ext4/inline.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index db6304c0..db1ca23d 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -34,6 +34,7 @@ static int get_max_inline_xattr_value_size(struct inode *inode,
+ 	struct ext4_xattr_ibody_header *header;
+ 	struct ext4_xattr_entry *entry;
+ 	struct ext4_inode *raw_inode;
++	void *end;
+ 	int free, min_offs;
+ 
+ 	if (!EXT4_INODE_HAS_XATTR_SPACE(inode))
+@@ -57,14 +58,23 @@ static int get_max_inline_xattr_value_size(struct inode *inode,
+ 	raw_inode = ext4_raw_inode(iloc);
+ 	header = IHDR(inode, raw_inode);
+ 	entry = IFIRST(header);
++	end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
+ 
+ 	/* Compute min_offs. */
+-	for (; !IS_LAST_ENTRY(entry); entry = EXT4_XATTR_NEXT(entry)) {
++	while (!IS_LAST_ENTRY(entry)) {
++		void *next = EXT4_XATTR_NEXT(entry);
++
++		if (next >= end) {
++			EXT4_ERROR_INODE(inode,
++					 "corrupt xattr in inline inode");
++			return 0;
++		}
+ 		if (!entry->e_value_inum && entry->e_value_size) {
+ 			size_t offs = le16_to_cpu(entry->e_value_offs);
+ 			if (offs < min_offs)
+ 				min_offs = offs;
+ 		}
++		entry = next;
+ 	}
+ 	free = min_offs -
+ 		((void *)entry - (void *)IFIRST(header)) - sizeof(__u32);
+-- 
+2.35.3
+
diff --git a/series.conf b/series.conf
index e33d5f9..f18f94d 100644
--- a/series.conf
+++ b/series.conf
@@ -967,6 +967,7 @@
 	patches.kernel.org/6.3.3-231-ext4-improve-error-recovery-code-paths-in-__ext.patch
 	patches.kernel.org/6.3.3-232-ext4-improve-error-handling-from-ext4_dirhash.patch
 	patches.kernel.org/6.3.3-233-ext4-fix-deadlock-when-converting-an-inline-dir.patch
+	patches.kernel.org/6.3.3-234-ext4-add-bounds-checking-in-get_max_inline_xatt.patch
 
 	########################################################
 	# Build fixes that apply to the vanilla kernel too.