From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D4AD1B4257 for ; Mon, 17 Nov 2025 06:32:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763361148; cv=none; b=dtIT1lD4BxT/mrW+VdHJBz58X8FjMFzGonA9t9j8QCc5Ww5Gwd0xSMA4m9QQv5AIBANadrLenqmcHlPhsvD78NcjS8BpxQJRfFt7vQ3O1NEBVnuGg8pwa/4u4XeUd27D5tgxFvcukWMISPYIGEiJqTdbGIiiq4Ew0dmYyCoarWk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763361148; c=relaxed/simple; bh=gLfHt9MTF2G7kFL5iYTHvcPM+9zYfYEnJq+3GfXx1gk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fLRshjZYNTy3QYxhJLBfpEyXCP1Vo672VzUmt3fYpbkFF8T/2gTaRsCYZWbxxjf9tknboFy9dxwmDTIjEKuirmgyut/zOPFYV1Cez41NZCOpb27XIGfDsYThwtFl78+bqROH19imwNnFjoBnGJQ4L6mHTyHi+jWMNkNuyTBAQoA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=K5OSfBaq; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="K5OSfBaq" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-340ba29d518so2742545a91.3 for ; Sun, 16 Nov 2025 22:32:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763361146; x=1763965946; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=37pLJ1j0OVF93d9c9E2IIMaroA64staVDd9dTWSzLpc=; b=K5OSfBaqU3S8GcIbBDW08PTT6/VDlB1Um3xS//RvOWAKvoox72tOCdY39TpLVzPZA2 K4xAd3Ys1qJ5+4n65FrfS+oNML1rguAGR/gz456MS774nbHftqUgFXz0TPsnppZvrdHK AoHpNrjh2KhsiHI3EplMvGbd2DMUcH8Kbhkk6Wtg037ZnAo+xvrV/WBXaQApExRW5BzD nG4HRN29Sj3wSfn885t/KCFIR1ecSjaorW3inmSw2+BRBh4z6zxmePz0a+xe3El9cgdZ 9M1figLDj19uAQILf9SsKYUE0CMS78L8OFTZr9DMuWJSKrTRB0i6Hx2Jl+APiyCsiR7N biqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763361146; x=1763965946; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=37pLJ1j0OVF93d9c9E2IIMaroA64staVDd9dTWSzLpc=; b=i0jwJGM/SrTpi4OgzZO7fTsk84qYzRuwBLt5qjvexjNChwveUudg15k1ccbxf57+yD QlJYxtbSMVDCaEnrmLAV55C52Qapl2kT4+iQhfzE4lvwSdftvXl4UgPaEHvVD5A/IzQ9 HIsyoPRlKAFL07Rl+qPMTHf/d2sUT2aVqYIlw71XhWK9BdXxPf+qJscDys6C7CXF4FMH bk7j/vlZ3K45X6RiuMo6ix39zSLzOuF0OWkYOMH/Iaui4fiBrUXkbZoB6WpJVU/X4dyB B2S9DzABnRfEOQh7v09KWfwzBG3F61s5zmbNYwNxM2ii2JcEn99i8e2yifTimOk5ipo/ z+9Q== X-Forwarded-Encrypted: i=1; AJvYcCVip4PoG3w221QUcP9yd0HwQ7XT6QufW/R/PBsHX+xjdelp3Vn/5Xmitl6Nb9FPVk/9vXeBoZ9846JiBmM=@vger.kernel.org X-Gm-Message-State: AOJu0YxdwhPeO2o306tjxXkIToWZz6/iYkMgeFqm4C22EY3ctMrw01FE YKKn8DE70Bz48qk20DNXJTg1jnk3CmMpWtGW4vcsMRJgGwl+U6fBNVRi X-Gm-Gg: ASbGnctaJMTc2QZROxZfwS2fYka/hj2/u+rJBCGWwqg/W+MMLjdZc8ul/GlO2HrXamy G5jL6nLADk4MEHoazHPFx2YeQDY4tGuLaVG/OZLAQCa1bsRU4wn4vE9zxr+wTaDStRTRk4yJd7x s2qSJp+Y0GSIFlduNklhrXJ4TMIZof0/TpbuTbsyYtc9psBd7bX7YPyTJw+EgnBJUNTsFdUlKm7 JD8yymfV3/eAVFJ0u5q8o3kKyELUXsStq00A/W2Yu80jNnMsK9ll5EeSYpSo3k18BMaJygs6BM9 qDiTfIqICVJ55BdtFLY+azESWI/FHHfuM2b4plCJVe02Re1tFbvwAnWqZS4ogDDI4LNsuhgcGcJ MY9iOcMuj+A3DEkHI2UNbsWMHJqOHyC58gqwxmIBr6NMLc888skbRchaPmdTMVsJMtZj5Pz6CYr ZMXarX+O2aGDtvnh7wMk4VLGaAC3xXs7+XXc8= X-Google-Smtp-Source: AGHT+IFJ5QD8qeDQHCNmcW/QYYS+QcGJ2HPHLjS5uSz5iZyAI4D/H7a4G/w1XdhK0Q2dgJRthXrhmw== X-Received: by 2002:a17:90b:2552:b0:340:2f48:b51a with SMTP id 98e67ed59e1d1-343f9ea5a78mr12690070a91.15.1763361146360; Sun, 16 Nov 2025 22:32:26 -0800 (PST) Received: from deepanshu-kernel-hacker.. ([2405:201:682f:389d:2dd9:39b3:a834:42df]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-343ead105c7sm6963713a91.6.2025.11.16.22.32.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 16 Nov 2025 22:32:25 -0800 (PST) From: Deepanshu Kartikey To: mark@fasheh.com, jlbec@evilplan.org, joseph.qi@linux.alibaba.com, heming.zhao@suse.com Cc: ocfs2-devel@lists.linux.dev, linux-kernel@vger.kernel.org, Deepanshu Kartikey , syzbot+ab0ad25088673470d2d9@syzkaller.appspotmail.com Subject: [PATCH v2] ocfs2: validate xattr entry count in ocfs2_xattr_list_entries Date: Mon, 17 Nov 2025 12:02:17 +0530 Message-ID: <20251117063217.5690-1-kartikey406@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Add validation of xattr entry count before accessing entries to prevent out-of-bounds array access and use-after-free bugs. A corrupted filesystem with an invalid xh_count value can cause the loop to access memory beyond the allocated block, potentially reaching freed memory pages. The validation calculates the maximum number of entries that can fit in the available space and rejects counts that exceed this limit. This prevents the subsequent loop from accessing invalid memory addresses. Without this check, the code directly uses xh_count from disk in array indexing operations like &header->xh_entries[i], which can point outside the block when xh_count is corrupted, triggering KASAN use-after-free detection. Reported-by: syzbot+ab0ad25088673470d2d9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ab0ad25088673470d2d9 Tested-by: syzbot+ab0ad25088673470d2d9@syzkaller.appspotmail.com Suggested-by: Heming Zhao Link: https://lore.kernel.org/all/20251111073831.2027072-1-kartikey406@gmail.com/ [v1] Signed-off-by: Deepanshu Kartikey --- Changes in v2: - Changed return value from -EUCLEAN to -EFSCORRUPTED for consistency with existing xattr error handling (suggested by Heming Zhao) fs/ocfs2/xattr.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index d70a20d29e3e..f7341e3d8a6c 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -928,8 +928,23 @@ static int ocfs2_xattr_list_entries(struct inode *inode, size_t result = 0; int i, type, ret; const char *name; + u16 count; + size_t max_entries; + struct super_block *sb = inode->i_sb; + + count = le16_to_cpu(header->xh_count); + max_entries = (sb->s_blocksize - sizeof(struct ocfs2_xattr_header)) / + sizeof(struct ocfs2_xattr_entry); - for (i = 0 ; i < le16_to_cpu(header->xh_count); i++) { + if (count > max_entries) { + ocfs2_error(sb, + "xattr entry count %u exceeds maximum %zu in inode %llu\n", + count, max_entries, + (unsigned long long)OCFS2_I(inode)->ip_blkno); + return -EFSCORRUPTED; + } + + for (i = 0; i < count; i++) { struct ocfs2_xattr_entry *entry = &header->xh_entries[i]; type = ocfs2_xattr_get_type(entry); name = (const char *)header + -- 2.43.0