Issues

ext2: ext2_creat leaks the allocated inode and sets no errno when the creation cannot be completed

#305

· Galfurian opened

on Sep 3, 2026

ext2: the direntry iterator loops forever on a zeroed directory block, so one rmdir can hang the kernel

#304

· Galfurian opened

on Sep 3, 2026

ext2: ext2_write_inode_data tests the block write as a boolean, so a full filesystem silently discards data and write() reports success

#303

· Galfurian opened

on Sep 3, 2026

ext2: ext2_free_inode never frees the indirect index blocks, so unlinking a large file leaks them

#302

· Galfurian opened

on Sep 3, 2026

ext2: block-pointer setter and reader disagree on the direct/indirect boundaries, corrupting block 12 and losing block 1036 of guest-written files

#301

· Galfurian opened

on Sep 3, 2026

signal: returning from a SIGSEGV handler livelocks the process in an unbounded fault loop

#296

· Galfurian opened

on Sep 3, 2026

ata: ata_device_read_sector swallows PIO errors — callers silently receive stale buffer contents

#291

· Galfurian opened

on Sep 2, 2026

misc correctness + tooling: vfs_creat errno clobber, dead CREAT_LAST_COMPONENT flag, ATA log newline, superblock prefix boundary, run-qemu-test stale-ISO guard

#289

· Galfurian opened

on Sep 1, 2026

namei: latent symlink-resolution hazards — memcpy without NUL and past-end write in __resolve_path (dead code until symlink support lands)

#288

· Galfurian opened

on Sep 1, 2026

sys_execve: filename is double-fetched from user memory (strnlen check, then strcpy/vfs re-reads) — hardening debt

#287

· Galfurian opened

on Sep 1, 2026

procfs: /proc/<pid>/stat builds into support[BUFSIZ=512] with only ~15 bytes of margin for 254-char task names

#286

· Galfurian opened

on Sep 1, 2026

ext2: on-disk names of exactly 255 chars (name_len == 255) trigger 1-byte out-of-bounds writes

#285

· Galfurian opened

on Sep 1, 2026

Navigation Menu

Uh oh!

All issues

ext2: ext2_creat leaks the allocated inode and sets no errno when the creation cannot be completed

ext2: the direntry iterator loops forever on a zeroed directory block, so one rmdir can hang the kernel

ext2: ext2_write_inode_data tests the block write as a boolean, so a full filesystem silently discards data and write() reports success

ext2: ext2_free_inode never frees the indirect index blocks, so unlinking a large file leaks them

ext2: block-pointer setter and reader disagree on the direct/indirect boundaries, corrupting block 12 and losing block 1036 of guest-written files

signal: returning from a SIGSEGV handler livelocks the process in an unbounded fault loop

ata: ata_device_read_sector swallows PIO errors — callers silently receive stale buffer contents

misc correctness + tooling: vfs_creat errno clobber, dead CREAT_LAST_COMPONENT flag, ATA log newline, superblock prefix boundary, run-qemu-test stale-ISO guard

namei: latent symlink-resolution hazards — memcpy without NUL and past-end write in __resolve_path (dead code until symlink support lands)

sys_execve: filename is double-fetched from user memory (strnlen check, then strcpy/vfs re-reads) — hardening debt

procfs: /proc/<pid>/stat builds into support[BUFSIZ=512] with only ~15 bytes of margin for 254-char task names

ext2: on-disk names of exactly 255 chars (name_len == 255) trigger 1-byte out-of-bounds writes

Uh oh!

Search results