An inode can hold extended attributes in the space that follows its extra fields, whose size is given by i_extra_isize. When ext4 loads an inode, ext4_iget_extra_inode() validates that space only if it starts with the xattr magic, and only then sets EXT4_STATE_XATTR. Without the magic, the space is treated as empty and is not checked. ext4_xattr_ibody_set() passes the space to ext4_xattr_set_entry() whether or not EXT4_STATE_XATTR is set. ext4_xattr_set_entry() walks the entries there to find min_offs, the lowest value offset. That offset decides whether the new value fits and where the value is copied: free = min_offs - ((void *)last - s->base) - sizeof(__u32); ... void *val = s->base + min_offs - new_size; A crafted image can leave non-zero bytes in that space without the magic where ext4 looks for it, for example by shrinking i_extra_isize. Those bytes are parsed as entries, and an entry that claims an in-inode value at offset 0 sets min_offs to 0. Because free is a size_t, the subtraction then wraps around to a huge value, and the free space check passes although the value does not fit. The value is copied new_size bytes before the start of the space, over the inode's own fields and, for a large value, the memory in front of the inode. On a kernel without KASAN, the copy corrupts memory: it overwrites the inode's own fields and, for a large value, also the memory in front of the inode. The bytes and their length are decided by the setxattr() caller. Nothing is freed and reused here, so the use-after-free in the report only reflects where the write happened to land. Triggering this issue requires mounting a crafted image, which needs CAP_SYS_ADMIN or automounting of removable media; after that, any setxattr() on the file reaches this path. The issue was found by fuzzing and has not been seen in production; a reproducer is available in the linked report. Clear the space in ext4_xattr_ibody_set() before calling ext4_xattr_set_entry() when EXT4_STATE_XATTR is not set, so that the walk starts from the empty entry list. Fixes: ac27a0ec112a ("[PATCH] ext4: initial copy of files from ext3") Closes: https://lore.kernel.org/lkml/CANypQFZzxTAH=4QRRDoqH6VAw1daAq88NDWiQKoM7QTOnP40sg@mail.gmail.com/ Cc: stable@vger.kernel.org Assisted-by: Claude Code:claude-opus-5 Signed-off-by: Jiaming Zhang --- fs/ext4/xattr.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 5c310747b965..2e5f39b710bd 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -2274,6 +2274,10 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode, if (IS_ERR(ea_inode)) return PTR_ERR(ea_inode); } + + if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR)) + memset(s->first, 0, s->end - (void *)s->first); + error = ext4_xattr_set_entry(i, s, handle, inode, ea_inode, false /* is_block */); if (error) { -- 2.43.0