Re: [PATCH v2] ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access

[Theodore Ts'o]

On Sat, 28 Mar 2026 20:30:38 +0530, Deepanshu Kartikey wrote:
> The bounds check for the next xattr entry in check_xattrs() uses
> (void *)next >= end, which allows next to point within sizeof(u32)
> bytes of end. On the next loop iteration, IS_LAST_ENTRY() reads 4
> bytes via *(__u32 *)(entry), which can overrun the valid xattr region.
> 
> For example, if next lands at end - 1, the check passes since
> next < end, but IS_LAST_ENTRY() reads 4 bytes starting at end - 1,
> accessing 3 bytes beyond the valid region.
> 
> [...]

Applied, thanks!

[1/1] ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
      commit: eceafc31ea7b42c984ece10d79d505c0bb6615d5

Best regards,
-- 
Theodore Ts'o <tytso@xxxxxxx>