[PATCH 3/5] fs: ext4: fix OOB read and infinite loop in ext_iterate()

[Sascha Hauer <s.hauer@pengutronix.de>]

ext_iterate() reads the entire directory into a buffer and walks it
parsing ext2_dirent entries, but has several issues with untrusted
on-disk data:

1. No check that a full ext2_dirent struct fits before reading it,
   causing an OOB read for the last partial entry.

2. No check that fpos + sizeof(dirent) + namelen fits within the
   buffer before passing the filename pointer to dir_emit(), causing
   an OOB read if namelen extends past the allocation.

3. If dirent->direntlen is 0, fpos never advances, causing an
   infinite loop.

Fix by:
- Checking that a full dirent struct fits before each iteration
- Validating that the filename region is within bounds before emitting
- Breaking out of the loop if direntlen is smaller than the minimum
  dirent size (which also catches the zero case)

All three are triggerable from a crafted ext4 filesystem image.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 fs/ext4/ext_barebox.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/ext_barebox.c b/fs/ext4/ext_barebox.c
index 5bee4853d4..ef1a71368d 100644
--- a/fs/ext4/ext_barebox.c
+++ b/fs/ext4/ext_barebox.c
@@ -157,15 +157,20 @@ static int ext_iterate(struct file *file, struct dir_context *ctx)
 		goto out;
 	}
 
-	while (fpos < dir->i_size) {
+	while (fpos + sizeof(struct ext2_dirent) <= dir->i_size) {
 		const struct ext2_dirent *dirent = buf + fpos;
 		const char *filename = buf + fpos + sizeof(*dirent);
+		uint16_t direntlen = le16_to_cpu(dirent->direntlen);
 
-		if (dirent->namelen != 0)
+		if (direntlen < sizeof(struct ext2_dirent))
+			break;
+
+		if (dirent->namelen != 0 &&
+		    fpos + sizeof(*dirent) + dirent->namelen <= dir->i_size)
 			dir_emit(ctx, filename, dirent->namelen,
 				 le32_to_cpu(dirent->inode), DT_UNKNOWN);
 
-		fpos += le16_to_cpu(dirent->direntlen);
+		fpos += direntlen;
 	}
 	ret = 0;
 out:

-- 
2.47.3