Re: [PATCH 1/3] xfs: bound node entries on path shifts

[Dave Chinner]

On Sun, Nov 08, 2026 at 03:49:58AM +0800, Shengzhuo Wei wrote:
> The da-node verifier uses the larger of the directory and attribute
> geometry limits, so an attribute node can pass verification with more
> entries than its buffer holds.  xfs_da3_path_shift() can load such a node
> without passing through the lookup path's geometry check, then index
> btree[] beyond the buffer.
> 
> Bound the count against args->geo->node_ents before indexing the entries
> and report filesystem corruption if it exceeds that limit.

These checks belong in the context of xfs_da3_header_check(),
not randomly placed in the code -after- calls to
xfs_da3_header_check().

-Dave.
-- 
Dave Chinner
dgc@xxxxxxxxxx