Re: [PATCH] xfs: validate attr entry pointer before field access

[Carlos Maiolino]

On Tue, 28 Jul 2026 15:43:40 +0800, Hongling Zeng wrote:
> xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen,
> valuelen) before checking if the entry pointer itself is within bounds.
> If nameidx is crafted to point near the end of the buffer, these field
> accesses can read out-of-bounds before the bounds check at
> name_end > buf_end is performed.
> 
> Add explicit bounds checks for entry pointers before accessing their
> fields. Use offsetof() to check that the start of the flexible array
> member (nameval/name) is within bounds, which ensures all preceding
> fields are safe to access.
> 
> [...]

Applied to for-next, thanks!

[1/1] xfs: validate attr entry pointer before field access
      commit: b7eea80be25f3334f131d52982b3131aba77b97d

Best regards,
-- 
Carlos Maiolino <cem@xxxxxxxxxx>