Messages in this thread |  | | From | "Theodore Ts'o" <> | | Subject | Re: [PATCH v2] ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access | | Date | Fri, 10 Apr 2026 11:18:34 -0400 |
| |
On Sat, 28 Mar 2026 20:30:38 +0530, Deepanshu Kartikey wrote: > The bounds check for the next xattr entry in check_xattrs() uses > (void *)next >= end, which allows next to point within sizeof(u32) > bytes of end. On the next loop iteration, IS_LAST_ENTRY() reads 4 > bytes via *(__u32 *)(entry), which can overrun the valid xattr region. > > For example, if next lands at end - 1, the check passes since > next < end, but IS_LAST_ENTRY() reads 4 bytes starting at end - 1, > accessing 3 bytes beyond the valid region. > > [...]
Applied, thanks!
[1/1] ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access commit: eceafc31ea7b42c984ece10d79d505c0bb6615d5
Best regards, -- Theodore Ts'o <tytso@mit.edu>
|  |