Re: [PATCH] xfs: validate attr entry pointer before field access
Carlos Maiolino <[email protected]>
| Newsgroups | org.kernel.vger.linux-xfs,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 28 Jul 2026 15:43:40 +0800, Hongling Zeng wrote:
> xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen,
> valuelen) before checking if the entry pointer itself is within bounds.
> If nameidx is crafted to point near the end of the buffer, these field
> accesses can read out-of-bounds before the bounds check at
> name_end > buf_end is performed.
>
> Add explicit bounds checks for entry pointers before accessing their
> fields. Use offsetof() to check that the start of the flexible array
> member (nameval/name) is within bounds, which ensures all preceding
> fields are safe to access.
>
> [...]
Applied to for-next, thanks!
[1/1] xfs: validate attr entry pointer before field access
commit: b7eea80be25f3334f131d52982b3131aba77b97d
Best regards,
--
Carlos Maiolino <[email protected]>