Re: [PATCH 5.10] ext4: fix out-of-bounds read in ext4_read_inline_dir()

[sashiko-bot@kernel.org]

> From: Xiang Mei <xmei5@asu.edu>
> 
> commit 9333cc809f0a89e001b814155a6cb8903a6274df upstream.
> 
> ext4_read_inline_dir() can read a dirent header past the end of its inline
> buffer, triggering a slab-out-of-bounds read during getdents64():
> 
>   BUG: KASAN: slab-out-of-bounds in __ext4_check_dir_entry
>   Read of size 2 at addr ffff88800f3dd23c by task exploit/148
>    ...
>    __ext4_check_dir_entry
>    ext4_read_inline_dir
>    iterate_dir
> 
> The dirent payload lives in a buffer of exactly inline_size bytes:
> [ ... ]
> Signed-off-by: Theodore Ts'o <tytso@mit.edu>
> [ mdmitrichenko: use EXT4_DIR_REC_LEN(1) instead of
>   ext4_dir_rec_len(1, NULL), which does not exist in 5.10; both compute
>   the same minimal dirent length. ]
> Signed-off-by: Mikhail Dmitrichenko <mdmitrichenko@astralinux.ru>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014153817.239-1-mdmitrichenko@astralinux.ru?part=1