lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <7debf2e6-0d2d-46bf-b3f8-f24c8e5f41b5@yandex.ru> Date: Thu, 3 Jul 2025 12:54:06 +0300 From: Dmitry Antipov <dmantipov@...dex.ru> To: "Darrick J. Wong" <djwong@...nel.org> Cc: Theodore Ts'o <tytso@....edu>, Andreas Dilger <adilger.kernel@...ger.ca>, linux-ext4@...r.kernel.org, syzbot+5322c5c260eb44d209ed@...kaller.appspotmail.com Subject: Re: [PATCH] ext4: verify dirent offset in ext4_readdir() On 7/2/25 6:23 PM, Darrick J. Wong wrote: > Why wouldn't you encode this check in __ext4_check_dir_entry and solve > this problem for all the callsites? Next thing to try indeed. BTW, looking through ext4_search_dir(), why the search doesn't actually start from the specified offset? I.e. shouldn't it be: diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index a178ac229489..8aa0d68dae71 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -1461,7 +1461,7 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, char * dlimit; int de_len; - de = (struct ext4_dir_entry_2 *)search_buf; + de = (struct ext4_dir_entry_2 *)search_buf + offset; dlimit = search_buf + buf_size; while ((char *) de < dlimit - EXT4_BASE_DIR_LEN) { /* this code is executed quadratically often */ Dmitry
Powered by blists - more mailing lists