From: Eric Sandeen <sandeen@redhat.com>
To: linux-ext4@vger.kernel.org
Cc: tytso@mit.edu, sandeen@redhat.com, agruenba@redhat.com
Subject: [PATCH 0/8] e2fsprogs: fix extended attribute iteration loop bounds checking
Date: Thu, 24 Sep 2026 17:23:34 -0500 [thread overview]
Message-ID: <20260924222944.3683556-1-sandeen@redhat.com> (raw)
This is also the result of some LLM scanning that Red Hat did.
The first patch in this series has the complete description of the
issues being addressed; the others follow that same pattern.
In short, extended attribute parsing loops across e2fsprogs share a
common set of bounds-checking bugs: they fail to reserve space for the
mandatory end marker, don't verify a complete entry header or name
record fits before accessing it, and miscalculate remaining free space
by ignoring 4-byte value alignment. </ai summary>
I'm sending these on behalf of Andreas because a few of us collaborated
on a big pile of reports and the original plan was to batch them
all up and send together regardless of authorship, but the list
got a bit too long for that. I still volunteered to handle the
series-sending.
Also, the AISLE attribution lines on these are what was requested.
If that's at all bothersome or unwanted, no problem sending without
that, or removal on merge.
Thanks,
-Eric
next reply other threads:[~2026-09-24 22:29 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-24 22:23 Eric Sandeen [this message]
2026-09-24 22:23 ` [PATCH 1/8] e2fsck: fix in-inode extended attribute checking Eric Sandeen
2026-09-24 22:23 ` [PATCH 2/8] e2fsck: fix extended attribute block checking Eric Sandeen
2026-09-24 22:23 ` [PATCH 3/8] e2fsck: fix ea loop in inc_ea_inode_refs Eric Sandeen
2026-09-24 22:23 ` [PATCH 4/8] libext2fs: fix ea loop in ext2fs_ext_attr_block_rehash Eric Sandeen
2026-09-24 22:23 ` [PATCH 5/8] libext2fs: fix ea loop in read_xattrs_from_buffer Eric Sandeen
2026-09-24 22:23 ` [PATCH 6/8] tune2fs: fix ea loop in update_xattr_entry_hashes Eric Sandeen
2026-09-24 22:23 ` [PATCH 7/8] resize2fs: " Eric Sandeen
2026-09-24 22:23 ` [PATCH 8/8] libext2fs: fix ea loop in ext2fs_xattr_inode_max_size Eric Sandeen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260924222944.3683556-1-sandeen@redhat.com \
--to=sandeen@redhat.com \
--cc=agruenba@redhat.com \
--cc=linux-ext4@vger.kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox