Re: [PATCH] ext4: fix out-of-bounds read in ext4_inlinedir_to_tree()

[sashiko-bot@kernel.org]

> ext4_inlinedir_to_tree() reads the on-disk dirent hash trailer without
> checking that it lies inside the inline directory payload:
> 
> 	if (ext4_hash_in_dirent(dir)) {
> 		hinfo->hash = EXT4_DIRENT_HASH(de);
> 		hinfo->minor_hash = EXT4_DIRENT_MINOR_HASH(de);
> 	}
> 
> EXT4_DIRENT_HASHES() derives the offset of the trailer from
> de->name_len alone, so for an entry whose rec_len ends exactly at
> inline_size the read starts past the kmalloc(inline_size) buffer that
> holds the payload.  Listing such an image with getdents64() gives:
> 
> 	BUG: KASAN: slab-out-of-bounds in ext4_inlinedir_to_tree+0xb6c/0xc00
> 	Read of size 4 at addr ffff8880052496bc by task init/1
> [ ... ]
> Fixes: 471fbbea7ff7 ("ext4: handle casefolding with encryption")
> Reported-by: Guikun Yang <yangguikun19@qq.com>
> Closes: https://lore.kernel.org/all/tencent_4F47889D184C7FA2287DC2A33A52F3BE9F09@qq.com/
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiahao Xu <xujiahao@cmss.chinamobile.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112091303.723243-1-xujiahao@cmss.chinamobile.com?part=1