[PATCH 2/5] ubifs: reject xattr inodes whose size does not match the value

[Zhihao Cheng]

在 2026/11/2 21:49, shao.mingyin at zte.com.cn 写道:
> An extended attribute inode stores the value in the inode node and
> UBIFS keeps inode->i_size equal to ubifs_inode->data_len (see
> create_xattr() and change_xattr()).  validate_inode() does not check
> this for inodes that carry UBIFS_XATTR_FL, so an image with a mismatch
> is accepted.  ubifs_xattr_get() and remove_xattr() then trip their
> ubifs_assert() on the invariant; with the assert=read-only or
> assert=panic mount option a plain getxattr() or removexattr() turns the
> file system read-only or panics the kernel.
> 
> Reject such inodes at iget time.
> 
> Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
> Cc: stable at vger.kernel.org
> Signed-off-by: Shao Mingyin <shao.mingyin at zte.com.cn>
> ---
> diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
> index 38972786817e..9f608c10b39e 100644
> --- a/fs/ubifs/super.c
> +++ b/fs/ubifs/super.c
> @@ -91,6 +91,18 @@ static int validate_inode(struct ubifs_info *c, const struct inode *inode)
>   	if (ui->xattr && !S_ISREG(inode->i_mode))
>   		return 5;
>   
> +	/*
> +	 * Extended attribute inodes keep the value in the inode node and
> +	 * maintain i_size == data_len everywhere (see create_xattr() and
> +	 * change_xattr()).
> +	 */
> +	if (ui->xattr && inode->i_size != ui->data_len) {
> +		ubifs_err(c, "xattr inode %llu has size %lld, but %d bytes of data",
> +			  inode->i_ino, (long long)inode->i_size,
> +			  ui->data_len);
> +		return 6;
> +	}
> +

Above two ui->xattr check could be merged like:
if (ui->xattr) {
   if (!S_ISREG(inode->i_mode))
     return 5;

   if (inode->i_size != ui->data_len)
     return 6;
}
>   	if (!ubifs_compr_present(c, ui->compr_type)) {
>   		ubifs_warn(c, "inode %llu uses '%s' compression, but it was not compiled in",
>   			   inode->i_ino, ubifs_compr_name(c, ui->compr_type));
> .
>