From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-gw01.astralinux.ru (mail-gw01.astralinux.ru [37.230.196.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A275A52CCED; Wed, 14 Oct 2026 15:54:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=37.230.196.243 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791993292; cv=none; b=SC5+oAa7VTR5CvTaTXnFQLUhVjQyanKFyawXdytiZbd0Z9GOhcQYIlaL098XS94Eh10QHzC482gqVkNLvHQhxBbakIUrB4Wi2uLCZXb5eSEglj5+yDx/V//rtYzsdTjUk20ZkmXNGxewwEtQkxOde93jPWaftKXXUN1hquwZ7WI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791993292; c=relaxed/simple; bh=gnxCA0/j6jwt98OXxKE9W3fC7U1N4I7UCE6ZMIwN4Qs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=M+GnTnpj2FhNiCxswExZkdwtXINeY1WJ8iJppUq1ffTkEIU+tGVzmYUBqW85Mc2Rqa+wD9XhJhWOnzi9WGflkRi4a8pYqfjaOd4AyaI3zs0kJzf/bwGiwwOUlvAJVO3v8N+leCeMrWFoVLJLMsEM6H1/HuqCMapBqtt+VjjeyBk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=astralinux.ru; spf=pass smtp.mailfrom=astralinux.ru; dkim=pass (2048-bit key) header.d=astralinux.ru header.i=@astralinux.ru header.b=iBPkKQ7a; arc=none smtp.client-ip=37.230.196.243 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=astralinux.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=astralinux.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=astralinux.ru header.i=@astralinux.ru header.b="iBPkKQ7a" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=astralinux.ru; s=mail; t=1791993276; bh=gnxCA0/j6jwt98OXxKE9W3fC7U1N4I7UCE6ZMIwN4Qs=; h=From:To:Cc:Subject:Date:From; b=iBPkKQ7aNxIGDRDfdIsuKOpTVXYgxh9jX1GhgJ1tD4UgTBZnrrymHQZmtK4Yov8UE AmB/K0jW2/kOIPriqq3wsrXTu6fFpIJ5JDvDoHT5pD3l+mxELxcHYOUKvehFMrB4H4 jf0hHAh/LlXdxH+50+UNTArYqHvIJgZai84W1163YAqIiSa3tewKOJg9N/ho5gYXBM c6zdDPYw4M22UpoCJ4Zdo4rrbgoOXcvHMCh7rwfMT4BoEwuKO2ajYlU/YHfH1Re8CO HJrRSZzFSzhhoylrgA+AX7IxmEkXanYLi1HBj1Svo5fdzqxCLsnTdHX4f+Hl9tvCa5 1tbImo5WOG9JQ== Received: from gca-sc-a-srv-ksmg01.astralinux.ru (localhost [127.0.0.1]) by mail-gw01.astralinux.ru (Postfix) with ESMTP id D8B8125E1A; Wed, 14 Oct 2026 18:54:36 +0300 (MSK) Received: from new-mail.astralinux.ru (unknown [10.205.207.5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail-gw01.astralinux.ru (Postfix) with ESMTPS; Wed, 14 Oct 2026 18:54:34 +0300 (MSK) Received: from DESKTOP-D46TNHI (unknown [10.198.48.143]) by new-mail.astralinux.ru (Postfix) with ESMTPA id 4j4b3F66lKz1b25; Wed, 14 Oct 2026 18:39:05 +0300 (MSK) From: Mikhail Dmitrichenko To: stable@vger.kernel.org, Greg Kroah-Hartman Cc: Mikhail Dmitrichenko , Sasha Levin , Xiang Mei , Jan Kara , "Theodore Ts'o" , Andreas Dilger , Baokun Li , Ojaswin Mujoo , "Ritesh Harjani (IBM)" , Zhang Yi , linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, Weiming Shi Subject: [PATCH 5.10] ext4: fix out-of-bounds read in ext4_read_inline_dir() Date: Wed, 14 Oct 2026 18:38:16 +0300 Message-ID: <20261014153817.239-1-mdmitrichenko@astralinux.ru> X-Mailer: git-send-email 2.54.0.windows.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-KSMG-AntiPhishing: NotDetected, bases: 2026/10/14 15:21:00 X-KSMG-AntiSpam-Auth: dkim=none X-KSMG-AntiSpam-Envelope-From: mdmitrichenko@astralinux.ru X-KSMG-AntiSpam-Info: LuaCore: 127 0.3.127 0884f7b061fa529b810563f359267cd65d2ec05c, {Tracking_one_susp_tld}, {Tracking_uf_ne_domains}, {Tracking_from_domain_doesnt_match_to}, astralinux.ru:7.1.1;new-mail.astralinux.ru:7.1.1;patch.msgid.link:7.1.1;d41d8cd98f00b204e9800998ecf8427e.com:7.1.1;127.0.0.199:7.1.2, FromAlignment: s X-KSMG-AntiSpam-Interceptor-Info: scan successful X-KSMG-AntiSpam-Lua-Profiles: 206688 [Oct 14 2026] X-KSMG-AntiSpam-Method: none X-KSMG-AntiSpam-Rate: 0 X-KSMG-AntiSpam-Status: not_detected X-KSMG-AntiSpam-Version: 6.1.1.27 X-KSMG-AntiVirus: Kaspersky Secure Mail Gateway, version 2.1.0.7854, bases: 2026/10/14 13:51:00 #28683811 X-KSMG-AntiVirus-Status: NotDetected, skipped X-KSMG-LinksScanning: NotDetected, bases: 2026/10/14 15:21:00 X-KSMG-Message-Action: skipped X-KSMG-Rule-ID: 1 From: Xiang Mei commit 9333cc809f0a89e001b814155a6cb8903a6274df upstream. ext4_read_inline_dir() can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents64(): BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry Read of size 2 at addr ffff88800f3dd23c by task exploit/148 ... __ext4_check_dir_entry ext4_read_inline_dir iterate_dir The dirent payload lives in a buffer of exactly inline_size bytes: dir_buf = kmalloc(inline_size, GFP_NOFS); but iteration runs in a position space extra_offset bytes larger (extra_size = extra_offset + inline_size) so the synthetic "." and ".." land at their block-dir offsets. A dirent is formed at "dir_buf + pos - extra_offset", yet the ext4_check_dir_entry() length argument uses the larger extra_size. A position whose dirent header would extend past extra_size is therefore accepted, and the rescan loop's rec_len probe and ext4_check_dir_entry() dereference de->rec_len before the entry is rejected. Reject a position whose minimum-size dirent header would not fit within extra_size before forming de, in both the rescan and main loops, and pass inline_size rather than extra_size to ext4_check_dir_entry() so the length check matches the physical buffer. Fixes: c4d8b0235aa9 ("ext4: fix readdir error in case inline_data+^dir_index.") Reported-by: Weiming Shi Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260615190519.946736-1-xmei5@asu.edu Signed-off-by: Theodore Ts'o [ mdmitrichenko: use EXT4_DIR_REC_LEN(1) instead of ext4_dir_rec_len(1, NULL), which does not exist in 5.10; both compute the same minimal dirent length. ] Signed-off-by: Mikhail Dmitrichenko --- Backport fix for CVE-2026-89786 fs/ext4/inline.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index edaa88202260..ff96caac04de 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -1563,6 +1563,8 @@ int ext4_read_inline_dir(struct file *file, /* for other entry, the real offset in * the buf has to be tuned accordingly. */ + if (i + EXT4_DIR_REC_LEN(1) > extra_size) + break; de = (struct ext4_dir_entry_2 *) (dir_buf + i - extra_offset); /* It's too expensive to do a full @@ -1597,10 +1599,17 @@ int ext4_read_inline_dir(struct file *file, continue; } + /* + * de lives at dir_buf + ctx->pos - extra_offset, within the + * kmalloc(inline_size) buffer. Make sure its header fits before + * ext4_check_dir_entry() dereferences de->rec_len. + */ + if (ctx->pos + EXT4_DIR_REC_LEN(1) > extra_size) + goto out; de = (struct ext4_dir_entry_2 *) (dir_buf + ctx->pos - extra_offset); if (ext4_check_dir_entry(inode, file, de, iloc.bh, dir_buf, - extra_size, ctx->pos)) + inline_size, ctx->pos)) goto out; if (le32_to_cpu(de->inode)) { if (!dir_emit(ctx, de->name, de->name_len, -- 2.43.0