Re: [PATCH] xfs: fix a UAF problem in xattr repair

["Darrick J. Wong" <djwong@kernel.org>]

On Fri, Dec 05, 2025 at 12:05:45AM -0800, Christoph Hellwig wrote:
> On Thu, Dec 04, 2025 at 01:43:50PM -0800, Darrick J. Wong wrote:
> > From: Darrick J. Wong <djwong@kernel.org>
> > 
> > The xchk_setup_xattr_buf function can allocate a new value buffer, which
> > means that any reference to ab->value before the call could become a
> > dangling pointer.  Fix this by moving an assignment to after the buffer
> > setup.
> 
> Looks good:
> 
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> 
> Do you have a test case for this?

Not yet, but working on it.  I'm working on a corruption problem I
occasionally see in the xattr leaf freemap code, so I think the trick is
that you have to generate a leaf block with a corruption that will cause
the scrubber to exit early having called xchk_*_set_corrupt, and then a
remote xattr with a value larger than xfs_attr_leaf_entsize_local_max.

Obviously this is easy to reproduce after I added a verifier check for
corrupt freemap data, but for older kernels I'd need to inject some
sort of corruption.  Probably twiddling the crc or something would
suffice, but ATM I'm a little absorbed in sorting out the freemap code
and stamping out the bugs.

--D