kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/fs/adfs
History
Bae Yeonju 1f0ed0f57f fs/adfs: validate nzones in adfs_validate_bblk() 
[ Upstream commit dd9d3e16c2 ]

Reject ADFS disc records with a zero zone count during boot block
validation, before the disc record is used.

When nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...)
which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to
dm[-1], causing an out-of-bounds write before the allocated buffer.

adfs_validate_dr0() already rejects nzones != 1 for old-format
images.  Add the equivalent check to adfs_validate_bblk() for
new-format images so that a crafted image with nzones == 0 is
rejected at probe time.

Found by syzkaller.

Fixes: f6f14a0d71 ("fs/adfs: map: move map-specific sb initialisation to map.c")
Signed-off-by: Bae Yeonju <iwasbaeyz@gmail.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-06-01 17:35:40 +02:00
..
adfs.h fs: make helpers idmap mount aware 2021-01-24 14:27:20 +01:00
dir.c fs/adfs: mostly divorse inode number from indirect disc address 2020-01-20 20:12:42 -05:00
dir_f.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
dir_f.h fs/adfs: dir: modernise on-disk directory structures 2020-01-20 20:12:41 -05:00
dir_fplus.c fs/adfs: bigdir: Fix an error code in adfs_fplus_read() 2020-01-25 11:31:59 -05:00
dir_fplus.h fs/adfs: dir: modernise on-disk directory structures 2020-01-20 20:12:41 -05:00
file.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
inode.c mm: require ->set_page_dirty to be explicitly wired up 2021-06-29 10:53:48 -07:00
Kconfig docs: filesystems: fix renamed references 2020-04-20 15:45:22 -06:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
map.c fs/adfs: map: fix map scanning 2020-01-20 20:12:40 -05:00
super.c fs/adfs: validate nzones in adfs_validate_bblk() 2026-06-01 17:35:40 +02:00