f2fs XattrEntry OOB

Vulnerability analysis

When the f2fs extended-attribute listing routine iterates over xattr entries, it reads a field from the entry header to look up a handler before checking whether the entry pointer is still within the valid xattr storage region. On a filesystem image with corrupted xattr metadata, the iterator can advance past the end of the valid area, and the premature header read becomes an out-of-bounds access into the surrounding kernel buffer. The fix moves the boundary validation ahead of any field access so that a corrupted entry is rejected with an error code before its contents are examined, instead of silently returning a partial successful listing. The vulnerable path is reached by mounting an f2fs filesystem image with crafted xattr data and then listing attributes on a file; mounting f2fs requires CAP_SYS_ADMIN in the init namespace, so an unprivileged user cannot trigger this directly.