Bryam Vargas 18227a6bc9 orangefs: keep the readdir entry size 64-bit in fill_from_part() ... fill_from_part() computes the size of a directory entry in size_t but stores it in a __u32. An entry length near U32_MAX wraps it to a small value, bypasses the bounds check, and is then used to index the entry, reading far past the directory part -- an out-of-bounds read that oopses the kernel. Compute the size as a u64 so it cannot truncate; the bounds check then rejects the entry. The trailer is supplied by the userspace client. Fixes: 480e3e532e ("orangefs: support very large directories") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Link: https://patch.msgid.link/20260619-b4-disp-50d2bd59-v1-1-ce332969b4a2@proton.me Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>		2026-07-01 15:26:27 +02:00
..
acl.c	posix_acl: make posix_acl_to_xattr() alloc the buffer	2026-01-16 10:51:12 +01:00
dcache.c	orangefs_d_revalidate(): use stable parent inode and name passed by caller	2025-01-27 19:25:24 -05:00
devorangefs-req.c
dir.c	orangefs: keep the readdir entry size 64-bit in fill_from_part()	2026-07-01 15:26:27 +02:00
downcall.h
file.c	mm.git review status for linus..mm-stable	2026-02-18 20:50:32 -08:00
inode.c	Orangefs: changes for 7.1	2026-04-17 17:03:43 -07:00
Kconfig
Makefile
namei.c	fs: Fix return in jfs_mkdir and orangefs_mkdir	2026-05-11 14:19:01 +02:00
orangefs-bufmap.c	bufmap: manage as folios, V2.	2026-04-13 12:14:17 -04:00
orangefs-bufmap.h	orangefs: Bufmap deadcoding	2025-03-18 19:39:19 -04:00
orangefs-cache.c	orangefs: add usercopy whitelist to orangefs_op_cache	2026-04-07 11:22:18 -04:00
orangefs-debug.h	orangefs: Move s_kmod_keyword_mask_map to orangefs-debugfs.c	2025-03-06 09:26:06 +01:00
orangefs-debugfs.c	debugfs: take better advantage of strscpy.	2026-04-07 11:25:54 -04:00
orangefs-debugfs.h
orangefs-dev-proto.h
orangefs-kernel.h	fs: refactor ->update_time handling	2026-01-12 14:01:32 +01:00
orangefs-mod.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
orangefs-sysfs.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
orangefs-sysfs.h
orangefs-utils.c	Coccinelle-based conversion to use ->i_state accessors	2025-10-20 20:22:26 +02:00
protocol.h
super.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
symlink.c
upcall.h
waitqueue.c
xattr.c	orangefs: validate getxattr response length	2026-04-07 11:28:19 -04:00