1 files changed, 41 insertions, 22 deletions

diff --git a/fs/xfs/libxfs/xfs_dir2_sf.c b/fs/xfs/libxfs/xfs_dir2_sf.c
index 96b45cd6c63f..e84af093b2ab 100644
--- a/fs/xfs/libxfs/xfs_dir2_sf.c
+++ b/fs/xfs/libxfs/xfs_dir2_sf.c
@@ -632,36 +632,49 @@ xfs_dir2_sf_check(
 /* Verify the consistency of an inline directory. */
 int
 xfs_dir2_sf_verify(
-        struct xfs_mount                *mp,
-        struct xfs_dir2_sf_hdr          *sfp,
-        int                             size)
+        struct xfs_inode                *ip)
 {
+        struct xfs_mount                *mp = ip->i_mount;
+        struct xfs_dir2_sf_hdr          *sfp;
         struct xfs_dir2_sf_entry        *sfep;
         struct xfs_dir2_sf_entry        *next_sfep;
         char                            *endp;
         const struct xfs_dir_ops        *dops;
+        struct xfs_ifork                *ifp;
         xfs_ino_t                       ino;
         int                             i;
         int                             i8count;
         int                             offset;
+        int                             size;
+        int                             error;
         __uint8_t                       filetype;
 
+        ASSERT(ip->i_d.di_format == XFS_DINODE_FMT_LOCAL);
+        /*
+         * xfs_iread calls us before xfs_setup_inode sets up ip->d_ops,
+         * so we can only trust the mountpoint to have the right pointer.
+         */
         dops = xfs_dir_get_ops(mp, NULL);
 
+        ifp = XFS_IFORK_PTR(ip, XFS_DATA_FORK);
+        sfp = (struct xfs_dir2_sf_hdr *)ifp->if_u1.if_data;
+        size = ifp->if_bytes;
+
         /*
          * Give up if the directory is way too short.
          */
-        XFS_WANT_CORRUPTED_RETURN(mp, size >
-                        offsetof(struct xfs_dir2_sf_hdr, parent));
-        XFS_WANT_CORRUPTED_RETURN(mp, size >=
-                        xfs_dir2_sf_hdr_size(sfp->i8count));
+        if (size <= offsetof(struct xfs_dir2_sf_hdr, parent) ||
+            size < xfs_dir2_sf_hdr_size(sfp->i8count))
+                return -EFSCORRUPTED;
 
         endp = (char *)sfp + size;
 
         /* Check .. entry */
         ino = dops->sf_get_parent_ino(sfp);
         i8count = ino > XFS_DIR2_MAX_SHORT_INUM;
-        XFS_WANT_CORRUPTED_RETURN(mp, !xfs_dir_ino_validate(mp, ino));
+        error = xfs_dir_ino_validate(mp, ino);
+        if (error)
+                return error;
         offset = dops->data_first_offset;
 
         /* Check all reported entries */
@@ -672,12 +685,12 @@ xfs_dir2_sf_verify(
                  * Check the fixed-offset parts of the structure are
                  * within the data buffer.
                  */
-                XFS_WANT_CORRUPTED_RETURN(mp,
-                                ((char *)sfep + sizeof(*sfep)) < endp);
+                if (((char *)sfep + sizeof(*sfep)) >= endp)
+                        return -EFSCORRUPTED;
 
                 /* Don't allow names with known bad length. */
-                XFS_WANT_CORRUPTED_RETURN(mp, sfep->namelen > 0);
-                XFS_WANT_CORRUPTED_RETURN(mp, sfep->namelen < MAXNAMELEN);
+                if (sfep->namelen == 0)
+                        return -EFSCORRUPTED;
 
                 /*
                  * Check that the variable-length part of the structure is
@@ -685,33 +698,39 @@ xfs_dir2_sf_verify(
                  * name component, so nextentry is an acceptable test.
                  */
                 next_sfep = dops->sf_nextentry(sfp, sfep);
-                XFS_WANT_CORRUPTED_RETURN(mp, endp >= (char *)next_sfep);
+                if (endp < (char *)next_sfep)
+                        return -EFSCORRUPTED;
 
                 /* Check that the offsets always increase. */
-                XFS_WANT_CORRUPTED_RETURN(mp,
-                                xfs_dir2_sf_get_offset(sfep) >= offset);
+                if (xfs_dir2_sf_get_offset(sfep) < offset)
+                        return -EFSCORRUPTED;
 
                 /* Check the inode number. */
                 ino = dops->sf_get_ino(sfp, sfep);
                 i8count += ino > XFS_DIR2_MAX_SHORT_INUM;
-                XFS_WANT_CORRUPTED_RETURN(mp, !xfs_dir_ino_validate(mp, ino));
+                error = xfs_dir_ino_validate(mp, ino);
+                if (error)
+                        return error;
 
                 /* Check the file type. */
                 filetype = dops->sf_get_ftype(sfep);
-                XFS_WANT_CORRUPTED_RETURN(mp, filetype < XFS_DIR3_FT_MAX);
+                if (filetype >= XFS_DIR3_FT_MAX)
+                        return -EFSCORRUPTED;
 
                 offset = xfs_dir2_sf_get_offset(sfep) +
                                 dops->data_entsize(sfep->namelen);
 
                 sfep = next_sfep;
         }
-        XFS_WANT_CORRUPTED_RETURN(mp, i8count == sfp->i8count);
-        XFS_WANT_CORRUPTED_RETURN(mp, (void *)sfep == (void *)endp);
+        if (i8count != sfp->i8count)
+                return -EFSCORRUPTED;
+        if ((void *)sfep != (void *)endp)
+                return -EFSCORRUPTED;
 
         /* Make sure this whole thing ought to be in local format. */
-        XFS_WANT_CORRUPTED_RETURN(mp, offset +
-               (sfp->count + 2) * (uint)sizeof(xfs_dir2_leaf_entry_t) +
-               (uint)sizeof(xfs_dir2_block_tail_t) <= mp->m_dir_geo->blksize);
+        if (offset + (sfp->count + 2) * (uint)sizeof(xfs_dir2_leaf_entry_t) +
+            (uint)sizeof(xfs_dir2_block_tail_t) > mp->m_dir_geo->blksize)
+                return -EFSCORRUPTED;
 
         return 0;
 }