Re: [PATCH 3/5] fs: ext4: fix OOB read and infinite loop in ext_iterate()

[Sascha Hauer <s.hauer@pengutronix.de>]

On Thu, Apr 02, 2026 at 12:12:31PM +0200, Sascha Hauer wrote:
> ext_iterate() reads the entire directory into a buffer and walks it
> parsing ext2_dirent entries, but has several issues with untrusted
> on-disk data:
> 
> 1. No check that a full ext2_dirent struct fits before reading it,
>    causing an OOB read for the last partial entry.
> 
> 2. No check that fpos + sizeof(dirent) + namelen fits within the
>    buffer before passing the filename pointer to dir_emit(), causing
>    an OOB read if namelen extends past the allocation.
> 
> 3. If dirent->direntlen is 0, fpos never advances, causing an
>    infinite loop.
> 
> Fix by:
> - Checking that a full dirent struct fits before each iteration
> - Validating that the filename region is within bounds before emitting
> - Breaking out of the loop if direntlen is smaller than the minimum
>   dirent size (which also catches the zero case)
> 
> All three are triggerable from a crafted ext4 filesystem image.
> 
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Fixes: 76cb57b4e107 ("fs: ext4: Switch to dentry cache implementation")

Sascha

> ---
>  fs/ext4/ext_barebox.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/ext4/ext_barebox.c b/fs/ext4/ext_barebox.c
> index 5bee4853d4..ef1a71368d 100644
> --- a/fs/ext4/ext_barebox.c
> +++ b/fs/ext4/ext_barebox.c
> @@ -157,15 +157,20 @@ static int ext_iterate(struct file *file, struct dir_context *ctx)
>  		goto out;
>  	}
>  
> -	while (fpos < dir->i_size) {
> +	while (fpos + sizeof(struct ext2_dirent) <= dir->i_size) {
>  		const struct ext2_dirent *dirent = buf + fpos;
>  		const char *filename = buf + fpos + sizeof(*dirent);
> +		uint16_t direntlen = le16_to_cpu(dirent->direntlen);
>  
> -		if (dirent->namelen != 0)
> +		if (direntlen < sizeof(struct ext2_dirent))
> +			break;
> +
> +		if (dirent->namelen != 0 &&
> +		    fpos + sizeof(*dirent) + dirent->namelen <= dir->i_size)
>  			dir_emit(ctx, filename, dirent->namelen,
>  				 le32_to_cpu(dirent->inode), DT_UNKNOWN);
>  
> -		fpos += le16_to_cpu(dirent->direntlen);
> +		fpos += direntlen;
>  	}
>  	ret = 0;
>  out:
> 
> -- 
> 2.47.3
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |