linux-ext4 - Re: [PATCH] ext4: verify dirent offset in ext4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250714033221.GB23343@mit.edu>
Date: Sun, 13 Jul 2025 23:32:21 -0400
From: "Theodore Ts'o" <tytso@....edu>
To: "Darrick J. Wong" <djwong@...nel.org>
Cc: Dmitry Antipov <dmantipov@...dex.ru>,
        Andreas Dilger <adilger.kernel@...ger.ca>, linux-ext4@...r.kernel.org,
        syzbot+5322c5c260eb44d209ed@...kaller.appspotmail.com
Subject: Re: [PATCH] ext4: verify dirent offset in ext4_readdir()

On Wed, Jul 02, 2025 at 08:23:04AM -0700, Darrick J. Wong wrote:
> 
> Why wouldn't you encode this check in __ext4_check_dir_entry and solve
> this problem for all the callsites?

More to the point, why wasn't this caught when checking the previous
directory entry in __ext4_check_ir_entry() via this:

	else if (unlikely(next_offset > size - ext4_dir_rec_len(1,
						  has_csum ? NULL : dir) &&
			  next_offset != size))
		error_msg = "directory entry too close to block end";

This patch claims to address a syzbot report, but it currently
doesn't have a C reprducer.  Are we sure that this change actually
makes a difference?

					- Ted