Darrick J. Wong 5990fd7569 xfs: fix a UAF problem in xattr repair ...

The xchk_setup_xattr_buf function can allocate a new value buffer, which
means that any reference to ab->value before the call could become a
dangling pointer.  Fix this by moving an assignment to after the buffer
setup.

Cc: stable@vger.kernel.org # v6.10
Fixes: e47dcf113a ("xfs: repair extended attributes")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>

2025-12-16 08:50:00 +01:00

..

agb_bitmap.c

…

agb_bitmap.h

xfs: create agblock bitmap helper to count the number of set regions

2024-02-22 12:43:37 -08:00

agheader_repair.c

xfs: fix CoW forks for realtime files

2024-12-23 13:06:17 -08:00

agheader.c

xfs: define the zoned on-disk format

2025-03-03 08:16:45 -07:00

agino_bitmap.h

xfs: repair AGI unlinked inode bucket lists

2024-04-15 14:58:58 -07:00

alloc_repair.c

xfs: add a realtime flag to the rmap update log redo items

2024-12-23 13:06:04 -08:00

alloc.c

xfs: add a generic group pointer to the btree cursor

2024-11-05 13:38:29 -08:00

attr_repair.c

xfs: fix a UAF problem in xattr repair

2025-12-16 08:50:00 +01:00

attr_repair.h

xfs: actually rebuild the parent pointer xattrs

2024-04-23 16:55:15 -07:00

attr.c

xfs: add a per-leaf block callback to xchk_xattr_walk

2024-04-23 16:55:15 -07:00

attr.h

xfs: repair extended attributes

2024-04-15 14:58:53 -07:00

bitmap.c

xfs: fix sparse warnings about unused interval tree functions

2024-04-22 12:51:43 +05:30

bitmap.h

xfs: create agblock bitmap helper to count the number of set regions

2024-02-22 12:43:37 -08:00

bmap_repair.c

xfs: check for shared rt extents when rebuilding rt file's data fork

2024-12-23 13:06:16 -08:00

bmap.c

xfs: allow COW forks on zoned file systems in xchk_bmap

2025-03-03 08:17:08 -07:00

btree.c

xfs: refactor xfs_btree_diff_two_ptrs() to take advantage of cmp_int()

2025-07-24 17:30:13 +02:00

btree.h

…

common.c

xfs: use the new ->i_state accessors

2025-10-20 20:22:27 +02:00

common.h

xfs: return the allocated transaction from xchk_trans_alloc_empty

2025-07-24 17:30:13 +02:00

cow_repair.c

xfs: remove the expr argument to XFS_TEST_ERROR

2025-09-18 17:32:02 +02:00

dab_bitmap.h

xfs: create an xattr iteration function for scrub

2024-04-15 14:58:54 -07:00

dabtree.c

xfs: scrub should set preen if attr leaf has holes

2024-04-15 14:58:54 -07:00

dabtree.h

xfs: flag empty xattr leaf blocks for optimization

2024-04-15 14:58:54 -07:00

dir_repair.c

xfs: return the allocated transaction from xchk_trans_alloc_empty

2025-07-24 17:30:13 +02:00

dir.c

xfs: scrub metadata directories

2024-11-05 13:38:34 -08:00

dirtree_repair.c

xfs: fix corruptions in the directory tree

2024-04-23 16:55:17 -07:00

dirtree.c

xfs: scrub metadata directories

2024-11-05 13:38:34 -08:00

dirtree.h

xfs: refactor directory tree root predicates

2024-11-05 13:38:33 -08:00

dqiterate.c

xfs: push q_qlock acquisition from xchk_dquot_iter to the callers.

2025-11-11 11:45:58 +01:00

findparent.c

xfs: scrub metadata directories

2024-11-05 13:38:34 -08:00

findparent.h

xfs: implement live updates for directory repairs

2024-04-23 16:55:13 -07:00

fsb_bitmap.h

…

fscounters_repair.c

xfs: disable sb_frextents for zoned file systems

2025-03-03 08:16:45 -07:00

fscounters.c

xfs: return the allocated transaction from xchk_trans_alloc_empty

2025-07-24 17:30:13 +02:00

fscounters.h

xfs: support RT inodes in xfs_mod_delalloc

2024-04-22 18:00:48 +05:30

health.c

xfs: scrub the realtime refcount btree

2024-12-23 13:06:14 -08:00

health.h

…

ialloc_repair.c

xfs: factor out a generic xfs_group structure

2024-11-05 13:38:27 -08:00

ialloc.c

xfs: return a 64-bit block count from xfs_btree_count_blocks

2024-12-12 17:45:09 -08:00

ino_bitmap.h

xfs: teach online scrub to find directory tree structure problems

2024-04-23 16:55:16 -07:00

inode_repair.c

xfs: use the new ->i_state accessors

2025-10-20 20:22:27 +02:00

inode.c

xfs: define the zoned on-disk format

2025-03-03 08:16:45 -07:00

iscan.c

xfs: factor out a generic xfs_group structure

2024-11-05 13:38:27 -08:00

iscan.h

xfs: scan the filesystem to repair a directory dotdot entry

2024-04-15 14:58:56 -07:00

listxattr.c

xfs: add a per-leaf block callback to xchk_xattr_walk

2024-04-23 16:55:15 -07:00

listxattr.h

xfs: add a per-leaf block callback to xchk_xattr_walk

2024-04-23 16:55:15 -07:00

metapath.c

xfs: scrub: use kstrdup_const() for metapath scan setups

2025-09-22 12:57:34 +02:00

newbt.c

xfs: remove static reap limits from repair.h

2025-09-05 08:48:23 -07:00

newbt.h

xfs: support repairing metadata btrees rooted in metadir inodes

2024-12-23 13:06:08 -08:00

nlinks_repair.c

xfs: return the allocated transaction from xchk_trans_alloc_empty

2025-07-24 17:30:13 +02:00

nlinks.c

xfs: fix locking in xchk_nlinks_collect_dir

2025-10-22 10:04:39 +02:00

nlinks.h

xfs: move files to orphanage instead of letting nlinks drop to zero

2024-04-15 14:58:57 -07:00

off_bitmap.h

…

orphanage.c

Merge tag 'vfs-6.19-rc1.directory.locking' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

2025-12-01 16:13:46 -08:00

orphanage.h

xfs: fix corruptions in the directory tree

2024-04-23 16:55:17 -07:00

parent_repair.c

xfs: return the allocated transaction from xchk_trans_alloc_empty

2025-07-24 17:30:13 +02:00

parent.c

xfs: use the new ->i_state accessors

2025-10-20 20:22:27 +02:00

quota_repair.c

xfs: move quota locking into xrep_quota_item

2025-11-11 11:45:58 +01:00

quota.c

xfs: move q_qlock locking into xchk_quota_item

2025-11-11 11:45:58 +01:00

quota.h

…

quotacheck_repair.c

xfs: move quota locking into xqcheck_commit_dquot

2025-11-11 11:45:58 +01:00

quotacheck.c

xfs: move q_qlock locking into xqcheck_compare_dquot

2025-11-11 11:45:58 +01:00

quotacheck.h

…

rcbag_btree.c

xfs: refactor cmp_key_with_cur routines to take advantage of cmp_int()

2025-07-24 17:30:13 +02:00

rcbag_btree.h

xfs: create refcount bag structure for btree repairs

2024-02-22 12:43:41 -08:00

rcbag.c

xfs: create refcount bag structure for btree repairs

2024-02-22 12:43:41 -08:00

rcbag.h

xfs: create refcount bag structure for btree repairs

2024-02-22 12:43:41 -08:00

readdir.c

xfs: refactor dir format helpers

2024-04-26 11:21:46 +05:30

readdir.h

xfs: deferred scrub of dirents

2024-04-23 07:47:02 -07:00

reap.c

xfs: use deferred reaping for data device cow extents

2025-09-05 08:48:23 -07:00

reap.h

xfs: fix CoW forks for realtime files

2024-12-23 13:06:17 -08:00

refcount_repair.c

xfs: online repair of the realtime refcount btree

2024-12-23 13:06:16 -08:00

refcount.c

xfs: namespace the maximum length/refcount symbols

2024-12-23 13:06:10 -08:00

repair.c

xfs: remove the expr argument to XFS_TEST_ERROR

2025-09-18 17:32:02 +02:00

repair.h

xfs: remove static reap limits from repair.h

2025-09-05 08:48:23 -07:00

rgb_bitmap.h

xfs: capture realtime CoW staging extents when rebuilding rt rmapbt

2024-12-23 13:06:16 -08:00

rgsuper.c

xfs: cross-reference the realtime rmapbt

2024-12-23 13:06:07 -08:00

rmap_repair.c

xfs: remove xrep_trans_{alloc,cancel}_hook_dummy

2025-07-24 17:30:13 +02:00

rmap.c

xfs: add a generic group pointer to the btree cursor

2024-11-05 13:38:29 -08:00

rtb_bitmap.h

xfs: fix CoW forks for realtime files

2024-12-23 13:06:17 -08:00

rtbitmap_repair.c

xfs: check new rtbitmap records against rt refcount btree

2024-12-23 13:06:16 -08:00

rtbitmap.c

xfs: support xchk_xref_is_used_rt_space on zoned file systems

2025-03-03 08:17:08 -07:00

rtbitmap.h

xfs: online repair of realtime bitmaps for a realtime group

2024-12-23 13:06:08 -08:00

rtrefcount_repair.c

xfs: fixup the metabtree reservation in xrep_reap_metadir_fsblocks

2025-03-03 08:16:43 -07:00

rtrefcount.c

xfs: online repair of the realtime refcount btree

2024-12-23 13:06:16 -08:00

rtrmap_repair.c

xfs: remove xrep_trans_{alloc,cancel}_hook_dummy

2025-07-24 17:30:13 +02:00

rtrmap.c

xfs: allow overlapping rtrmapbt records for shared data extents

2024-12-23 13:06:15 -08:00

rtsummary_repair.c

xfs: online repair of realtime bitmaps for a realtime group

2024-12-23 13:06:08 -08:00

rtsummary.c

xfs: allow queued realtime intents to drain before scrubbing

2024-12-23 13:06:06 -08:00

rtsummary.h

xfs: replace m_rsumsize with m_rsumblocks

2024-09-01 08:58:19 -07:00

scrub.c

xfs: return the allocated transaction from xfs_trans_alloc_empty

2025-07-24 17:30:13 +02:00

scrub.h

xfs: constify feature checks

2025-01-13 14:57:08 +01:00

stats.c

xfs: scrub the realtime refcount btree

2024-12-23 13:06:14 -08:00

stats.h

…

symlink_repair.c

xfs: fix out of bounds memory read error in symlink repair

2025-11-20 11:06:24 +01:00

symlink.c

xfs: online repair of symbolic links

2024-04-15 14:58:58 -07:00

tempexch.h

xfs: online repair of realtime bitmaps for a realtime group

2024-12-23 13:06:08 -08:00

tempfile.c

xfs: online repair of realtime bitmaps for a realtime group

2024-12-23 13:06:08 -08:00

tempfile.h

xfs: move repair temporary files to the metadata directory tree

2024-11-05 13:38:34 -08:00

trace.c

xfs: compute per-AG extent reap limits dynamically

2025-09-05 08:48:22 -07:00

trace.h

xfs: compute file mapping reap limits dynamically

2025-09-05 08:48:22 -07:00

xfarray.c

xfs: Use folio_next_pos()

2025-10-31 13:11:38 +01:00

xfarray.h

xfs: reduce the rate of cond_resched calls inside scrub

2024-04-23 16:55:17 -07:00

xfblob.c

xfs: repair extended attributes

2024-04-15 14:58:53 -07:00

xfblob.h

xfs: online repair of directories

2024-04-15 14:58:55 -07:00

xfile.c

mm,tmpfs: consider end of file write in shmem_is_huge

2024-09-09 16:39:12 -07:00

xfile.h

xfs: repair extended attributes

2024-04-15 14:58:53 -07:00

xfs_scrub.h

xfs: introduce vectored scrub mode

2024-04-23 16:55:18 -07:00