From 87fa086f9efd0ac54d861171c177d3484479d086 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Mon, 19 Jan 2009 02:04:16 +0100
Subject: [PATCH] --- yaml --- r: 140069 b: refs/heads/master c:
 2809f76afce05a73e08120f455107912aa519647 h: refs/heads/master i:   140067:
 ab76e6ca5383c67fc192453998ba31eacbc21ba5 v: v3

---
 [refs]                   |  2 +-
 trunk/fs/xfs/xfs_inode.c | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 721f0e8a9879..595ed2ac9f1d 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 7884bc8617e6b8afda8cb8853cf14abfd3148d5c
+refs/heads/master: 2809f76afce05a73e08120f455107912aa519647
diff --git a/trunk/fs/xfs/xfs_inode.c b/trunk/fs/xfs/xfs_inode.c
index be2ca4d67b53..e7ae08d1df48 100644
--- a/trunk/fs/xfs/xfs_inode.c
+++ b/trunk/fs/xfs/xfs_inode.c
@@ -424,6 +424,19 @@ xfs_iformat(
 	case XFS_DINODE_FMT_LOCAL:
 		atp = (xfs_attr_shortform_t *)XFS_DFORK_APTR(dip);
 		size = be16_to_cpu(atp->hdr.totsize);
+
+		if (unlikely(size < sizeof(struct xfs_attr_sf_hdr))) {
+			xfs_fs_repair_cmn_err(CE_WARN, ip->i_mount,
+				"corrupt inode %Lu "
+				"(bad attr fork size %Ld).",
+				(unsigned long long) ip->i_ino,
+				(long long) size);
+			XFS_CORRUPTION_ERROR("xfs_iformat(8)",
+					     XFS_ERRLEVEL_LOW,
+					     ip->i_mount, dip);
+			return XFS_ERROR(EFSCORRUPTED);
+		}
+
 		error = xfs_iformat_local(ip, dip, XFS_ATTR_FORK, size);
 		break;
 	case XFS_DINODE_FMT_EXTENTS: