]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
orangefs: keep the readdir entry size 64-bit in fill_from_part()
authorBryam Vargas <hexlabsecurity@proton.me>
Fri, 19 Jun 2026 09:38:20 +0000 (04:38 -0500)
committerChristian Brauner <brauner@kernel.org>
Wed, 1 Jul 2026 13:26:27 +0000 (15:26 +0200)
commit18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc
treef92cc68e2ec4abef8f22254187023e7a6a9c9229
parent704d48d81dc41470e108811c32c577ada66192d4
orangefs: keep the readdir entry size 64-bit in fill_from_part()

fill_from_part() computes the size of a directory entry in size_t but
stores it in a __u32. An entry length near U32_MAX wraps it to a small
value, bypasses the bounds check, and is then used to index the entry,
reading far past the directory part -- an out-of-bounds read that oopses
the kernel.

Compute the size as a u64 so it cannot truncate; the bounds check then
rejects the entry. The trailer is supplied by the userspace client.

Fixes: 480e3e532e31 ("orangefs: support very large directories")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260619-b4-disp-50d2bd59-v1-1-ce332969b4a2@proton.me
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
fs/orangefs/dir.c