Re: [PATCH 3/5] fs: ext4: fix OOB read and infinite loop in ext_iterate()

Sascha Hauer
2026-04-02T10:46:25Z

On Thu, Apr 02, 2026 at 12:12:31PM +0200, Sascha Hauer wrote:
> ext_iterate() reads the entire directory into a buffer and walks it
> parsing ext2_dirent entries, but has several issues with untrusted
> on-disk data:
>
> 1. No check that a full ext2_dirent struct fits before reading it,
> causing an OOB read for the last partial entry.
>
> 2. No check that fpos + sizeof(dirent) + namelen fits within the
> buffer before passing the filename pointer to dir_emit(), causing
> an OOB read if namelen extends past the allocation.
>
> 3. If dirent->direntlen is 0, fpos never advances, causing an
> infinite loop.
>
> Fix by:
> - Checking that a full dirent struct fits before each iteration
> - Validating that the filename region is within bounds before emitting
> - Breaking out of the loop if direntlen is smaller than the minimum
> dirent size (which also catches the zero case)
>
> All three are triggerable from a crafted ext4 filesystem image.
>
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Fixes: 76cb57b4e107 ("fs: ext4: Switch to dentry cache implementation")

Sascha

> ---
> fs/ext4/ext_barebox.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/fs/ext4/ext_barebox.c b/fs/ext4/ext_barebox.c
> index 5bee4853d4..ef1a71368d 100644
> --- a/fs/ext4/ext_barebox.c
> +++ b/fs/ext4/ext_barebox.c
> @@ -157,15 +157,20 @@ static int ext_iterate(struct file *file, struct dir_context *ctx)
> goto out;
> }
>
> - while (fpos < dir->i_size) {
> + while (fpos + sizeof(struct ext2_dirent) <= dir->i_size) {
> const struct ext2_dirent *dirent = buf + fpos;
> const char *filename = buf + fpos + sizeof(*dirent);
> + uint16_t direntlen = le16_to_cpu(dirent->direntlen);
>
> - if (dirent->namelen != 0)
> + if (direntlen < sizeof(struct ext2_dirent))
> + break;
> +
> + if (dirent->namelen != 0 &&
> + fpos + sizeof(*dirent) + dirent->namelen <= dir->i_size)
> dir_emit(ctx, filename, dirent->namelen,
> le32_to_cpu(dirent->inode), DT_UNKNOWN);
>
> - fpos += le16_to_cpu(dirent->direntlen);
> + fpos += direntlen;
> }
> ret = 0;
> out:
>
> --
> 2.47.3
>
>

--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |