Re: [PATCH] freevxfs: fix off-page read on a crafted dirblock

[Christian Brauner]

On 2026-07-26 15:25 +0900, Baul Lee wrote:
> vxfs_readdir() and vxfs_find_entry() both advance the intra-page offset
> pg_ofs by VXFS_DIRBLKOV(sbi, dbp) at each dirblock boundary and then
> dereference
> 
> 	de = (struct vxfs_direct *)(kaddr + pg_ofs);
> 
> without re-checking pg_ofs against PAGE_SIZE in between.  The enclosing
> while (pg_ofs < PAGE_SIZE && pos < limit) test only gates loop
> re-entry, not the deref that follows the addition in the same
> iteration.
> 
> VXFS_DIRBLKOV() is 2 * d_nhash + 4, and d_nhash is an unvalidated
> on-disk __fs16, so the overhead is attacker arithmetic of up to roughly
> 32 pages.  kaddr is page_address() of the single order-0 page-cache
> page returned by vxfs_get_page(), so nothing else bounds the addition
> and the de->d_reclen load lands off the mapped page.  Directory pages
> are consumed unvalidated: vxfs_check_page() was never implemented, only
> a commented-out call survives.
> 
> Both sites are reachable on any mounted crafted freevxfs image, the
> vxfs_readdir() one from an unprivileged getdents64(2) and the
> vxfs_find_entry() one from any path walk into the directory.  When
> d_ino is non-zero vxfs_readdir() also feeds the off-page bytes to
> dir_emit(), so they reach userspace.  KASAN reports a 2-byte
> out-of-bounds read in vxfs_readdir().
> 
> Re-check pg_ofs against PAGE_SIZE right after the addition and before
> the deref in both loops, restoring the invariant they already assume.
> The added break leaves the page the same way the existing zero-d_reclen
> break does.  Well-formed directories, whose overhead never pushes
> pg_ofs past a single dirblock, are unaffected.
> 
> Discovered by XBOW, triaged by Baul Lee <baul.lee@xxxxxxxx>
> 
> Fixes: 12495ea3ac47 ("freevxfs: refactor readdir and lookup code")
> Reported-by: Federico Kirschbaum <federico.kirschbaum@xxxxxxxx>
> Reported-by: Baul Lee <baul.lee@xxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Baul Lee <baul.lee@xxxxxxxx>
> ---
>  fs/freevxfs/vxfs_lookup.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/freevxfs/vxfs_lookup.c b/fs/freevxfs/vxfs_lookup.c
> index 138e08de976e..b068f93359fb 100644
> --- a/fs/freevxfs/vxfs_lookup.c
> +++ b/fs/freevxfs/vxfs_lookup.c
> @@ -87,6 +87,8 @@ vxfs_find_entry(struct inode *ip, struct dentry *dp, struct page **ppp)
>  
>  				pos += overhead;
>  				pg_ofs += overhead;
> +				if (pg_ofs >= PAGE_SIZE)
> +					break;
>  			}
>  			de = (struct vxfs_direct *)(kaddr + pg_ofs);
>  
> @@ -237,6 +239,8 @@ vxfs_readdir(struct file *fp, struct dir_context *ctx)
>  
>  				pos += overhead;
>  				pg_ofs += overhead;
> +				if (pg_ofs >= PAGE_SIZE)
> +					break;

There's valid Sashiko reviews that you want to read through.