Re: [PATCH] ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

[Theodore Ts'o]

On Thu, 09 Jul 2026 11:41:01 -0700, Xiang Mei wrote:
> For casefolded encrypted directories ext4 stores an 8-byte hash trailer
> after the name (EXT4_DIRENT_HASHES()), at an offset derived from
> de->name_len.  On the sb_no_casefold_compat_fallback() path ext4_match()
> reads that trailer, but ext4_search_dir()'s by-hand pre-check only tests
> de->name + de->name_len <= dlimit, which proves the name fits, not the
> rounded trailer.  A crafted entry whose name ends at the block boundary
> passes the check while EXT4_DIRENT_HASHES(de) lands past the block end,
> so ext4_match() reads out of bounds on an ordinary lookup.  KASAN reports
> it as a use-after-free when the page after the directory block holds a
> freed object:
> 
> [...]

Applied, thanks!

[1/1] ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
      commit: c7e6b863d298f56522d0d08554bbea7f142e6588

Best regards,
-- 
Theodore Ts'o <tytso@xxxxxxx>