Re: [PATCH v2] ext4: validate readdir offset before accessing dirent
"Theodore Ts'o" <[email protected]>
| Newsgroups | org.kernel.vger.linux-ext4,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <178481171743.796182.460536597002637440.b4-ty@b4> |
On Mon, 06 Jul 2026 12:13:13 +0800, Yao Kai wrote:
> A corrupted directory can trigger the following KASAN report when
> ext4_readdir() resumes from an invalid position:
>
> BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820
> Read of size 2 at addr ffff88810a646000 by task repro_linear/509
>
> Call Trace:
> <TASK>
> dump_stack_lvl+0x53/0x70
> print_report+0xd0/0x630
> kasan_report+0xce/0x100
> __ext4_check_dir_entry+0x5ef/0x820
> ext4_readdir+0xcde/0x2b70
> iterate_dir+0x1a1/0x520
> __x64_sys_getdents64+0x12b/0x220
> do_syscall_64+0xf9/0x540
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> </TASK>
>
> [...]
Applied, thanks!
[1/1] ext4: validate readdir offset before accessing dirent
commit: bc4b7b0414c33b2c8898eb04386df0d21a13dad8
Best regards,
--
Theodore Ts'o <[email protected]>