[PATCH] reiserfs: continue checking leaf items after directories

[PATCH] reiserfs: continue checking leaf items after directories

[Kyle Zeng]

is_leaf() validates each item header in a leaf before the leaf is
trusted by search_by_key().  The directory-item case currently returns
the result of has_valid_deh_location() directly from inside that loop.
If the first directory item is valid, the whole leaf is accepted and any
later item headers are never checked.

A crafted leaf can put a valid directory item before a malformed later
stat-data, direct, indirect, or directory item.  search_by_key() can then
select the unchecked item and consumers use ih_item_body() on attacker
controlled ih_location/ih_item_len values.

Keep the directory-entry validation, but only fail the leaf when that
validation fails.  If it succeeds, continue the item-header loop so the
remaining headers are checked.

Fixes: 13d257503c09 ("reiserfs: check directory items on read from disk")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 fs/reiserfs/stree.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
index 5faf702f8d15..0f4eb9627a39 100644
--- a/fs/reiserfs/stree.c
+++ b/fs/reiserfs/stree.c
@@ -479,7 +479,8 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh)
 						 ih);
 				return 0;
 			}
-			return has_valid_deh_location(bh, ih);
+			if (!has_valid_deh_location(bh, ih))
+				return 0;
 		}
 		prev_location = ih_location(ih);
 	}
-- 
2.43.0