Corrupt i_xattr_inline_size can move the computed inode-body xattr header
outside the dinode block. Several OCFS2 paths then trust xh_count or
xattr entry geometry from that unchecked header.

The reported KASAN splat hits the ibody lookup path:

  BUG: KASAN: use-after-free in ocfs2_xattr_find_entry+0x37b/0x3a0
  ocfs2_xattr_ibody_get()
  ocfs2_xattr_get_nolock()
  ocfs2_calc_xattr_init()

The same unchecked header derivation also exists in the outside-value
probe, ibody remove, inline refcount attach, and inline reflink paths.

This series factors the existing ibody list validation into a shared
helper and then converts the remaining inline-header consumers one at a
time.

Patch layout:

1. validate ibody get/find and reuse the helper in ibody list
2. validate the outside-value probe
3. validate ibody remove
4. validate inline refcount attach
5. validate inline reflink

ZhengYuan Huang (5):
  ocfs2: validate inline xattr header before ibody lookups
  ocfs2: validate inline xattr header before checking outside values
  ocfs2: validate inline xattr header before ibody remove
  ocfs2: validate inline xattr header before inline refcount attach
  ocfs2: validate inline xattr header before reflinking inline xattrs

 fs/ocfs2/xattr.c | 123 ++++++++++++++++++++++++++++-------------------
 1 file changed, 73 insertions(+), 50 deletions(-)

-- 
2.43.0