LU-12911 llite: Don't access lov_md fields before size check

[fs/lustre-release.git] / lustre / llite / xattr.c

diff --git a/lustre/llite/xattr.c b/lustre/llite/xattr.c
index 0c50a59..829584d 100644 (file)
--- a/lustre/llite/xattr.c
+++ b/lustre/llite/xattr.c
@@ -283,6 +283,12 @@ static int ll_setstripe_ea(struct dentry *dentry, struct lov_user_md *lump,
        if (!size && lump)
                lump = NULL;
 
+       if (size && size < sizeof(*lump)) {
+               /* ll_adjust_lum() or ll_lov_user_md_size() might access
+                * before size - just give up now.
+                */
+               return -ERANGE;
+       }
        rc = ll_adjust_lum(inode, lump);
        if (rc)
                return rc;