[PATCH 3/5] fs: ext4: fix OOB read and infinite loop in ext_iterate()

Sascha Hauer
2026-04-02T10:13:18Z

ext_iterate() reads the entire directory into a buffer and walks it
parsing ext2_dirent entries, but has several issues with untrusted
on-disk data:

1. No check that a full ext2_dirent struct fits before reading it,
causing an OOB read for the last partial entry.

2. No check that fpos + sizeof(dirent) + namelen fits within the
buffer before passing the filename pointer to dir_emit(), causing
an OOB read if namelen extends past the allocation.

3. If dirent->direntlen is 0, fpos never advances, causing an
infinite loop.

Fix by:
- Checking that a full dirent struct fits before each iteration
- Validating that the filename region is within bounds before emitting
- Breaking out of the loop if direntlen is smaller than the minimum
dirent size (which also catches the zero case)

All three are triggerable from a crafted ext4 filesystem image.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
fs/ext4/ext_barebox.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/ext_barebox.c b/fs/ext4/ext_barebox.c
index 5bee4853d4..ef1a71368d 100644
--- a/fs/ext4/ext_barebox.c
+++ b/fs/ext4/ext_barebox.c
@@ -157,15 +157,20 @@ static int ext_iterate(struct file *file, struct dir_context *ctx)
goto out;
}

- while (fpos < dir->i_size) {
+ while (fpos + sizeof(struct ext2_dirent) <= dir->i_size) {
const struct ext2_dirent *dirent = buf + fpos;
const char *filename = buf + fpos + sizeof(*dirent);
+ uint16_t direntlen = le16_to_cpu(dirent->direntlen);

- if (dirent->namelen != 0)
+ if (direntlen < sizeof(struct ext2_dirent))
+ break;
+
+ if (dirent->namelen != 0 &&
+ fpos + sizeof(*dirent) + dirent->namelen <= dir->i_size)
dir_emit(ctx, filename, dirent->namelen,
le32_to_cpu(dirent->inode), DT_UNKNOWN);

- fpos += le16_to_cpu(dirent->direntlen);
+ fpos += direntlen;
}
ret = 0;
out:

--
2.47.3