From: Dave Chinner <dgc@kernel.org>
To: Shengzhuo Wei <me@cherr.cc>
Cc: Carlos Maiolino <cem@kernel.org>, Long Li <leo.lilong@huawei.com>,
"Darrick J. Wong" <djwong@kernel.org>,
linux-xfs@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH 1/3] xfs: bound node entries on path shifts
Date: Tue, 10 Nov 2026 08:25:18 +1100 [thread overview]
Message-ID: <avI6PtE8RdHWz8QE@dread> (raw)
In-Reply-To: <20261108-twin-20261106-fs-xfs-da-node-v1-1-0d4bd47938ba@cherr.cc>
On Sun, Nov 08, 2026 at 03:49:58AM +0800, Shengzhuo Wei wrote:
> The da-node verifier uses the larger of the directory and attribute
> geometry limits, so an attribute node can pass verification with more
> entries than its buffer holds. xfs_da3_path_shift() can load such a node
> without passing through the lookup path's geometry check, then index
> btree[] beyond the buffer.
>
> Bound the count against args->geo->node_ents before indexing the entries
> and report filesystem corruption if it exceeds that limit.
These checks belong in the context of xfs_da3_header_check(),
not randomly placed in the code -after- calls to
xfs_da3_header_check().
-Dave.
--
Dave Chinner
dgc@kernel.org
next prev parent reply other threads:[~2026-11-09 21:25 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-07 19:49 [PATCH 0/3] xfs: bound da-node entry counts Shengzhuo Wei
2026-11-07 19:49 ` [PATCH 1/3] xfs: bound node entries on path shifts Shengzhuo Wei
2026-11-09 21:25 ` Dave Chinner [this message]
2026-11-07 19:49 ` [PATCH 2/3] xfs: bound attr node entries on inactivation Shengzhuo Wei
2026-11-07 19:50 ` [PATCH 3/3] xfs: bound attr node entries in listxattr Shengzhuo Wei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=avI6PtE8RdHWz8QE@dread \
--to=dgc@kernel.org \
--cc=cem@kernel.org \
--cc=djwong@kernel.org \
--cc=leo.lilong@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-xfs@vger.kernel.org \
--cc=me@cherr.cc \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.