Re: [PATCH] ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
"Theodore Ts'o" <[email protected]>
| Newsgroups | org.kernel.vger.linux-ext4,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <178481171749.796182.4958325647124265197.b4-ty@b4> |
On Thu, 09 Jul 2026 11:41:01 -0700, Xiang Mei wrote:
> For casefolded encrypted directories ext4 stores an 8-byte hash trailer
> after the name (EXT4_DIRENT_HASHES()), at an offset derived from
> de->name_len. On the sb_no_casefold_compat_fallback() path ext4_match()
> reads that trailer, but ext4_search_dir()'s by-hand pre-check only tests
> de->name + de->name_len <= dlimit, which proves the name fits, not the
> rounded trailer. A crafted entry whose name ends at the block boundary
> passes the check while EXT4_DIRENT_HASHES(de) lands past the block end,
> so ext4_match() reads out of bounds on an ordinary lookup. KASAN reports
> it as a use-after-free when the page after the directory block holds a
> freed object:
>
> [...]
Applied, thanks!
[1/1] ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
commit: c7e6b863d298f56522d0d08554bbea7f142e6588
Best regards,
--
Theodore Ts'o <[email protected]>