[PATCH 0/3] xfs: bound da-node entry counts

[PATCH 0/3] xfs: bound da-node entry counts

[Shengzhuo Wei]

The da-node verifier cannot distinguish directory and attribute geometry.
With multi-block directories it accepts an attribute node count that is
valid for a directory but larger than the attribute buffer.  These
patches add fork-specific bounds in xfs_da3_path_shift(),
xfs_attr3_node_inactive(), and xfs_attr_node_list_lookup(), preventing
out-of-bounds reads and the inactivation write.

Signed-off-by: Shengzhuo Wei <me@cherr.cc>
---
Shengzhuo Wei (3):
      xfs: bound node entries on path shifts
      xfs: bound attr node entries on inactivation
      xfs: bound attr node entries in listxattr

 fs/xfs/libxfs/xfs_da_btree.c | 5 +++++
 fs/xfs/xfs_attr_inactive.c   | 8 ++++++++
 fs/xfs/xfs_attr_list.c       | 3 +++
 3 files changed, 16 insertions(+)
---
base-commit: d68ce4e71248e1ff5af9654b407541d9260b3ba5
change-id: 20261106-twin-20261106-fs-xfs-da-node-e319621e1c48

Best regards,
--  
Shengzhuo Wei <me@cherr.cc>

[PATCH 1/3] xfs: bound node entries on path shifts

[Shengzhuo Wei]

The da-node verifier uses the larger of the directory and attribute
geometry limits, so an attribute node can pass verification with more
entries than its buffer holds.  xfs_da3_path_shift() can load such a node
without passing through the lookup path's geometry check, then index
btree[] beyond the buffer.

Bound the count against args->geo->node_ents before indexing the entries
and report filesystem corruption if it exceeds that limit.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
---
 fs/xfs/libxfs/xfs_da_btree.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/xfs/libxfs/xfs_da_btree.c b/fs/xfs/libxfs/xfs_da_btree.c
index faf88488265c..88788ece69c6 100644
--- a/fs/xfs/libxfs/xfs_da_btree.c
+++ b/fs/xfs/libxfs/xfs_da_btree.c
@@ -2242,6 +2242,11 @@ xfs_da3_path_shift(
 			xfs_da3_node_hdr_from_disk(dp->i_mount, &nodehdr,
 						   bp->b_addr);
 			btree = nodehdr.btree;
+			if (nodehdr.count > args->geo->node_ents) {
+				xfs_buf_mark_corrupt(blk->bp);
+				xfs_da_mark_sick(args);
+				return -EFSCORRUPTED;
+			}
 			blk->hashval = be32_to_cpu(btree[nodehdr.count - 1].hashval);
 			if (forward)
 				blk->index = 0;

-- 
2.47.3

[PATCH 2/3] xfs: bound attr node entries on inactivation

[Shengzhuo Wei]

The da-node verifier can accept an attribute node count that only fits
a larger directory block.  Inactivation bypasses the lookup path's
geometry check, so __xfs_da3_node_remove() can read and write beyond the
attribute buffer.  For a v5 filesystem with 4 KiB blocks and 64 KiB
directory blocks, count 8184 causes a 65464-byte memmove.

Reject counts above mp->m_attr_geo->node_ents before removing entries.
This also bounds subsequent removals, since the count only decreases.

Fixes: b854e1c4eff3 ("xfs: close crash window in attr dabtree inactivation")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
---
 fs/xfs/xfs_attr_inactive.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
index a5b69c0fbfd05..b8230fa458fff 100644
--- a/fs/xfs/xfs_attr_inactive.c
+++ b/fs/xfs/xfs_attr_inactive.c
@@ -153,6 +153,14 @@ xfs_attr3_node_inactive(
 	}
 
 	xfs_da3_node_hdr_from_disk(mp, &ichdr, bp->b_addr);
+
+	if (ichdr.count > mp->m_attr_geo->node_ents) {
+		xfs_buf_mark_corrupt(bp);
+		xfs_trans_brelse(*trans, bp);
+		xfs_dirattr_mark_sick(dp, XFS_ATTR_FORK);
+		return -EFSCORRUPTED;
+	}
+
 	parent_blkno = xfs_buf_daddr(bp);
 	if (!ichdr.count) {
 		xfs_trans_brelse(*trans, bp);

-- 
2.47.3

[PATCH 3/3] xfs: bound attr node entries in listxattr

[Shengzhuo Wei]

xfs_attr_node_list_lookup() walks the attribute dabtree with the
on-disk node count and indexes btree[] without a fork-specific
geometry check.  The node verifier only bounds the count against the
larger of the directory and attribute geometries, so a crafted attr
node can pass verification with more entries than its buffer holds.

Reject counts above mp->m_attr_geo->node_ents before the btree[] walk.
Use the existing corruption and sick reporting path.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
---
 fs/xfs/xfs_attr_list.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c
index f751edb930b6..667740e37c83 100644
--- a/fs/xfs/xfs_attr_list.c
+++ b/fs/xfs/xfs_attr_list.c
@@ -258,6 +258,9 @@ xfs_attr_node_list_lookup(
 		if (nodehdr.level >= XFS_DA_NODE_MAXDEPTH)
 			goto out_corruptbuf;
 
+		if (nodehdr.count > mp->m_attr_geo->node_ents)
+			goto out_corruptbuf;
+
 		/* Check the level from the root node. */
 		if (cursor->blkno == 0)
 			expected_level = nodehdr.level - 1;

-- 
2.47.3

Re: [PATCH 1/3] xfs: bound node entries on path shifts

[Dave Chinner]

On Sun, Nov 08, 2026 at 03:49:58AM +0800, Shengzhuo Wei wrote:
> The da-node verifier uses the larger of the directory and attribute
> geometry limits, so an attribute node can pass verification with more
> entries than its buffer holds.  xfs_da3_path_shift() can load such a node
> without passing through the lookup path's geometry check, then index
> btree[] beyond the buffer.
> 
> Bound the count against args->geo->node_ents before indexing the entries
> and report filesystem corruption if it exceeds that limit.

These checks belong in the context of xfs_da3_header_check(),
not randomly placed in the code -after- calls to
xfs_da3_header_check().

-Dave.
-- 
Dave Chinner
dgc@kernel.org