From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793814690; b=e/u6BBudRRwyat/XjbisZPIXPvfhry0WQPx7BaheGAaaRTU0XwMFYsmZoW4tDWo0/ofa ZG1jYTZnVkfKVnP0TymIJPJf9R0O21njUDSzGxPSELsJxJcKuwVDuA9efYgPtJSCni5nU v+hCI+ranoTSPZ0oebBoWZf12rNQTbcLY1UvMXEhqz26N5ENnI0HegYTlNbcDjsTbDTcc a5ku4zxUlHghD8bE0JqinNnCJ1TMVzzzODOP/FogyY/6/pyjvzbhzN/szDqd7zM5x7gmW sT80/EZgJf6ZuCpqBzihiweenO0SuJUiGzWBVVF4LUQDo5yXzHw6t3uTdPIe/nv0XGA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793814690; h=Received:DKIM-Signature:Subject:To:Cc:From:Date:Message-ID: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=Ot3rTlwpZc11Tlcqg0XcCq9St1BSoswEcU8wcC3J5TQ=; b=j7kYa83wlaSjKivFq01pnoNI/vtXvhWuQEdZr1UN9xhMmECfDkvMdyVqiUiU1HpPWPQh hCzCwvGIx0kGPvoJpyH8HmzVxBV3/eGCsbe5Z1mhDRl6xmnE5oxgYfKK/jEVGDsUYw/+4 Rd4V6WV/QS632kdTz8uhMTyArmpM2glOWLKG5yEDzEs2C152KjKE/cEVuW/9VTe1KePoT OZzl8Dzn5nrpXwirMEBHZtEO70vMTVd7AT4No3R4myC4ZqkkacEq/X5NXaNnRft9A2x8R 5ms8vKUB75KOuO3eXoTEC/81lcVu1XbsaSK24rRFFDowzQmjsxXEobRsdxa0HaHPOmg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=lALFIGc1; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8B1D6606D81B for ; Wed, 4 Nov 2026 17:51:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=lALFIGc1 Received: by smtp.kernel.org (Postfix) with ESMTPSA id ACB051F00A15; Wed, 4 Nov 2026 17:51:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793814690; bh=Ot3rTlwpZc11Tlcqg0XcCq9St1BSoswEcU8wcC3J5TQ=; h=Subject:To:Cc:From:Date; b=lALFIGc1ETyLgWPlAswitnQv5hhBzUl+0Pyrmj9h652usu94E6sh0zhw8n3rG6X0w gLI3brV5QBsHh6HcKEWcZIqyYFJov3zfoMAV6UsAOqoVHVsZ7hf4fiL113ksiaf+9r WEORfUSrCPNJTOMI2GndDT4Qz4eLJqkAlp28tNTA= Subject: FAILED: patch "[PATCH] xfs: check for buffer overruns when examining local/remote" failed to apply to 7.3-stable tree To: djwong@kernel.org,cem@kernel.org,hch@lst.de Cc: From: Date: Wed, 04 Nov 2026 12:51:27 -0500 Message-ID: <2026110427-acrobat-squeak-f5e8@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 7.3-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-7.3.y git checkout FETCH_HEAD git cherry-pick -x 91c41f9524906a8ebd2ae68c98a07b4bd5255ddb # git commit -s git send-email --to '' --in-reply-to '2026110427-acrobat-squeak-f5e8@gregkh' --subject-prefix 'PATCH 7.3.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 91c41f9524906a8ebd2ae68c98a07b4bd5255ddb Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Mon, 12 Oct 2026 08:23:12 -0700 Subject: [PATCH] xfs: check for buffer overruns when examining local/remote xattr entries LOLLM noticed that the xattr scrub and repair code can walk off the end of the buffer if the xattr entry record starts so close to the end of the buffer that there's not even space for the entry structure itself. Strengthen the bounds checking here. Cc: stable@vger.kernel.org # v4.15 Fixes: 13791d3b833428 ("xfs: scrub extended attribute leaf space") Signed-off-by: Darrick J. Wong Assisted-by: LOLLM # finding obvious bugs Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino diff --git a/fs/xfs/scrub/attr.c b/fs/xfs/scrub/attr.c index f7c00ea1af5d..f909e2b25158 100644 --- a/fs/xfs/scrub/attr.c +++ b/fs/xfs/scrub/attr.c @@ -306,6 +306,12 @@ xchk_xattr_local_entry( char *name_end; unsigned int namesize; + name_end = (char *)lentry + offsetof(typeof(*lentry), nameval[0]); + if (name_end > buf_end) { + xchk_da_set_corrupt(ds, level); + return 0; + } + namesize = xfs_attr_leaf_entsize_local(lentry->namelen, be16_to_cpu(lentry->valuelen)); name_end = (char *)lentry + namesize; @@ -335,6 +341,12 @@ xchk_xattr_remote_entry( char *name_end; unsigned int namesize; + name_end = (char *)rentry + offsetof(typeof(*rentry), name[0]); + if (name_end > buf_end) { + xchk_da_set_corrupt(ds, level); + return 0; + } + namesize = xfs_attr_leaf_entsize_remote(rentry->namelen); name_end = (char *)rentry + namesize; if (rentry->namelen == 0) { diff --git a/fs/xfs/scrub/attr_repair.c b/fs/xfs/scrub/attr_repair.c index f2868fb4d27a..720090895c20 100644 --- a/fs/xfs/scrub/attr_repair.c +++ b/fs/xfs/scrub/attr_repair.c @@ -285,6 +285,7 @@ xrep_xattr_salvage_local_attr( struct xfs_attr_leaf_name_local *lentry) { struct xchk_xattr_buf *ab = rx->sc->buf; + char *name_end; unsigned char *value; unsigned int valuelen; unsigned int namesize; @@ -293,10 +294,14 @@ xrep_xattr_salvage_local_attr( * Decode the leaf local entry format. If something seems wrong, we * junk the attribute. */ + name_end = (char *)lentry + offsetof(typeof(*lentry), nameval[0]); + if (name_end > buf_end) + return 0; value = &lentry->nameval[lentry->namelen]; valuelen = be16_to_cpu(lentry->valuelen); namesize = xfs_attr_leaf_entsize_local(lentry->namelen, valuelen); - if ((char *)lentry + namesize > buf_end) + name_end = (char *)lentry + namesize; + if (name_end > buf_end) return 0; if (!xrep_xattr_want_salvage(rx, ent->flags, lentry->nameval, lentry->namelen, value, valuelen)) @@ -333,8 +338,8 @@ xrep_xattr_salvage_remote_attr( .attr_filter = ent->flags & XFS_ATTR_NSP_ONDISK_MASK, .namelen = rentry->namelen, .name = rentry->name, - .valuelen = be32_to_cpu(rentry->valuelen), }; + char *name_end; unsigned int namesize; int error; @@ -343,9 +348,14 @@ xrep_xattr_salvage_remote_attr( * junk the attribute. Note that we should never find a zero-length * remote attribute value. */ - namesize = xfs_attr_leaf_entsize_remote(rentry->namelen); - if ((char *)rentry + namesize > buf_end) + name_end = (char *)rentry + offsetof(typeof(*rentry), name[0]); + if (name_end > buf_end) return 0; + namesize = xfs_attr_leaf_entsize_remote(rentry->namelen); + name_end = (char *)rentry + namesize; + if (name_end > buf_end) + return 0; + args.valuelen = be32_to_cpu(rentry->valuelen); if (args.valuelen == 0 || !xrep_xattr_want_salvage(rx, ent->flags, rentry->name, rentry->namelen, NULL, args.valuelen))