[RFC PATCH] xfs: don't run off the end of the buffer reading inline dirents

["Darrick J. Wong" <darrick.wong@oracle.com>]

Check that we don't run off the end of the inline data buffer when we're
trying to read directory entries.  xfs/348 triggered kernel memory being
exposed to userspace and a related complaint from the usercopy code.

Evidently once we call dir_emit, the VFS ignores error return values
since it's already begun copying data back to userspace.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 fs/xfs/xfs_dir2_readdir.c |    8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c
index 003a99b..70bdd21 100644
--- a/fs/xfs/xfs_dir2_readdir.c
+++ b/fs/xfs/xfs_dir2_readdir.c
@@ -69,6 +69,7 @@ xfs_dir2_sf_getdents(
 	xfs_dir2_dataptr_t	dotdot_offset;
 	xfs_ino_t		ino;
 	struct xfs_da_geometry	*geo = args->geo;
+	char *endp;
 
 	ASSERT(dp->i_df.if_flags & XFS_IFINLINE);
 	/*
@@ -83,6 +84,7 @@ xfs_dir2_sf_getdents(
 	ASSERT(dp->i_df.if_u1.if_data != NULL);
 
 	sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
+	endp = dp->i_df.if_u1.if_data + dp->i_df.if_bytes;
 
 	if (dp->i_d.di_size < xfs_dir2_sf_hdr_size(sfp->i8count))
 		return -EFSCORRUPTED;
@@ -130,6 +132,12 @@ xfs_dir2_sf_getdents(
 	for (i = 0; i < sfp->count; i++) {
 		__uint8_t filetype;
 
+		/* If we pass the end of the buffer, we're done. */
+		if (((char *)sfep + sizeof(*sfep)) >= endp ||
+		    (char *)dp->d_ops->sf_nextentry(sfp, sfep) > endp) {
+			break;
+		}
+
 		off = xfs_dir2_db_off_to_dataptr(geo, geo->datablk,
 				xfs_dir2_sf_get_offset(sfep));