]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
fs/ntfs3: Fix an NULL dereference bug
authorDan Carpenter <dan.carpenter@linaro.org>
Tue, 17 Oct 2023 14:04:39 +0000 (17:04 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 16 Feb 2024 18:14:25 +0000 (19:14 +0100)
commit686820fe141ea0220fc6fdfc7e5694f915cf64b2
treeb0d080b485e9d8104eca9335d2a03371fb26885f
parentf125d00e61baeb1831e9c35f4120ac7ef9ba1b56
fs/ntfs3: Fix an NULL dereference bug

[ Upstream commit b2dd7b953c25ffd5912dda17e980e7168bebcf6c ]

The issue here is when this is called from ntfs_load_attr_list().  The
"size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow
on a 64bit systems but on 32bit systems the "+ 1023" can overflow and
the result is zero.  This means that the kmalloc will succeed by
returning the ZERO_SIZE_PTR and then the memcpy() will crash with an
Oops on the next line.

Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/ntfs3/ntfs_fs.h