Re: [PATCH ext4 v4] ext4: fix out-of-bounds read in ext4_read_inline_dir()
"Theodore Ts'o" <[email protected]>
| Newsgroups | org.kernel.vger.linux-ext4 |
|---|---|
| Message-ID | <178481171729.796182.15100587696186879447.b4-ty@b4> |
On Mon, 15 Jun 2026 12:05:19 -0700, Xiang Mei wrote:
> ext4_read_inline_dir() can read a dirent header past the end of its inline
> buffer, triggering a slab-out-of-bounds read during getdents64():
>
> BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry
> Read of size 2 at addr ffff88800f3dd23c by task exploit/148
> ...
> __ext4_check_dir_entry
> ext4_read_inline_dir
> iterate_dir
>
> [...]
Applied, thanks!
[1/1] ext4: fix out-of-bounds read in ext4_read_inline_dir()
commit: 9333cc809f0a89e001b814155a6cb8903a6274df
Best regards,
--
Theodore Ts'o <[email protected]>