linux-kernel - Re: [PATCH] jfs: add dtroot integrity check to prevent index out-of-bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4cffc24f-69b6-4869-8f1c-81b7c1ba133c@windriver.com>
Date: Tue, 9 Dec 2025 10:41:12 +0800
From: "Zhou, Yun" <yun.zhou@...driver.com>
To: Dave Kleikamp <dave.kleikamp@...cle.com>
Cc: rand.sec96@...il.com, contact@...aud-lcm.com, kovalev@...linux.org,
        zheng.yu@...thwestern.edu, eadavis@...com,
        jfs-discussion@...ts.sourceforge.net, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] jfs: add dtroot integrity check to prevent index
 out-of-bounds

Hi Shaggy,

Thank you for your reply.  I am willing to continue investigating and 
resolving
these issues, and look forward to your suggestions.Yun
On 12/2/25 06:31, Dave Kleikamp wrote:
>
> On 11/20/25 9:43AM, Yun Zhou wrote:
>> Add check_dtroot() to validate dtroot_t integrity, focusing on 
>> preventing
>> index/pointer overflows from on-disk corruption.
>>
>> Key checks:
>>   - freecnt bounded by [0, DTROOTMAXSLOT-1] (slot[0] reserved for 
>> header).
>>   - freelist validity: -1 when freecnt=0; 1~DTROOTMAXSLOT-1 when 
>> non-zero,
>>     with linked list checks (no duplicates, proper termination via 
>> next=-1).
>>   - stbl bounds: nextindex within stbl array size; entries within 
>> 0~8, no
>>     duplicates (excluding idx=0).
>>
>> Invoked in copy_from_dinode() when loading directory inodes, catching
>> corruption early before directory operations trigger out-of-bounds 
>> access.
>
> I really like the idea of these patches. I'm swamped with some other
> work and have been out on vacation a bit, but I do intend to give these
> a good review and hopefully integrate them. Thanks for your patience.
>
> Shaggy