averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

xfs: validate attr entry pointer before field access

Browse Source 
commit b7eea80be2 upstream.

xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen,
valuelen) before checking if the entry pointer itself is within bounds.
If nameidx is crafted to point near the end of the buffer, these field
accesses can read out-of-bounds before the bounds check at
name_end > buf_end is performed.

Add explicit bounds checks for entry pointers before accessing their
fields. Use offsetof() to check that the start of the flexible array
member (nameval/name) is within bounds, which ensures all preceding
fields are safe to access.

Fixes: c84760659d ("xfs: check attribute leaf block structure")
Cc: <stable@vger.kernel.org> # v5.5
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Hongling Zeng
2026-08-27 14:29:45 +02:00
committed by Greg Kroah-Hartman
parent 46116f574b
commit e99120b594
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/xfs/libxfs/xfs_attr_leaf.c
+14
View File
@@ -267,6 +267,13 @@ xfs_attr3_leaf_verify_entry(
*/
if (ent->flags & XFS_ATTR_LOCAL) {
lentry = xfs_attr3_leaf_name_local(leaf, idx);
/* Validate lentry pointer is within bounds before field access */
if ((char *)lentry >= buf_end)
return __this_address;
if ((char *)lentry + offsetof(struct xfs_attr_leaf_name_local, nameval) > buf_end)
return __this_address;
namesize = xfs_attr_leaf_entsize_local(lentry->namelen,
be16_to_cpu(lentry->valuelen));
name_end = (char *)lentry + namesize;
@@ -274,6 +281,13 @@ xfs_attr3_leaf_verify_entry(
return __this_address;
} else {
rentry = xfs_attr3_leaf_name_remote(leaf, idx);
/* Validate rentry pointer is within bounds before field access */
if ((char *)rentry >= buf_end)
return __this_address;
if ((char *)rentry + offsetof(struct xfs_attr_leaf_name_remote, name) > buf_end)
return __this_address;
namesize = xfs_attr_leaf_entsize_remote(rentry->namelen);
name_end = (char *)rentry + namesize;
if (rentry->namelen == 0)