From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2FD2352023 for ; Sun, 28 Jun 2026 09:56:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782640621; cv=none; b=CstdDAv2gzlaHjhhd99WNhrz+GXsPH8EcoX6HvcGQvsSA5weNbkBAa6BqtB7/VpZj2vh6iwpxMNWzBFerDrX6FK+dOTRf7Jfaps5xOxRnLc50LKcGI8kDg4n8Lfd9cOA9ndvBemwU9IC1dJVlZ8vumsmratvm+eAZNU+yolHaqo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782640621; c=relaxed/simple; bh=iI6UpRpfUgXDkri4EcJW5TuLXyA/5MefvjbCl/LO6PE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=lEmXspQBbuGOh75SLlnBsyo6jeZY63hVVatd2NWmoSZm94oqbO22NLePofuUZQ7AvfR6qJczdlKFe+fLKNjWOjeQWcjKMM74vfVQ4v/Ikad0FPl3y5mn74MW/nFv1tgO+6dy5uDcZ/Lkf0rtyUZaiU0FvUb0m6/+WQlm4QsCs9k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BlRvGMne; arc=none smtp.client-ip=209.85.221.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BlRvGMne" Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-46cbe01d4b6so1317079f8f.2 for ; Sun, 28 Jun 2026 02:56:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782640617; x=1783245417; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Jg43f+XEb4q5xqiQSXTBL+eF+ouBz+XEK14Aa67BdH8=; b=BlRvGMneybrpiyDA7FgSdX//ugILgGi6Cm3Es0POJq3ejan/qfFn6kklnAfuMo1Hzw p7F7GADnOqunXDLlOknalzGaKZYU43NnMcOWp77R3d3n/BLTf/6v5FniKVonl3i/Ex5S zcjdIRSVY6y4JCTfguSioHD6QSoFCcSv9AT4LkDrSk29esJKnHw/nUqR3o5NWiyPlzQy LXCWZSW2O6QzUVBM/66tle3HZuHxstJYS5VXIzbycydtz+u474mnV1/wi4HkIAmzWHCp w4N47xKp94mmYJN3WoC7xQzZXYXBQkey8I68R74TLs4NP0ctaeUs4RQf2geHOmJ1nlqE loTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782640617; x=1783245417; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Jg43f+XEb4q5xqiQSXTBL+eF+ouBz+XEK14Aa67BdH8=; b=R2EGM+P3lV0HaMrAU34zDIjZ4ohn/08dR+7KnGAthOqVXweZynIZSR99e25saMn+AE RC3EYtVvfABXW8/mboIIOg+OmFhs8Ka47L/qj+ySQt+yJit6QvA8YoCSfShI6Ehj5fwT UyCVrlE70HD30KrJk0WEuYY32H4Fbr60/wyrWSI3nLtkZvi/527asLjyIhN9cfzY836C h1Jnhx8hGVzeS+cv5JPBp+xvnjUY9B7bXQToIzRuJNTOOk+xQCx+m7/xdvFEkK3waG1j GM2JGnBSQHtafHu9eCuibloBDR0MHixPAVoN4noankqYt9Za3sdJDbvGv6T9Pyz1FigI ZlKw== X-Forwarded-Encrypted: i=1; AHgh+RoXrjB46k/WXxF3pjBdYZO40IexDiDuZqx/A0b+XRob2oLn4Oh2TjcOg9cnZneIgsfaTcsBdXJ7ReTXFHs=@vger.kernel.org X-Gm-Message-State: AOJu0Yxy8uDfId+ll+WmmUiuOYKbdTb76UcKFjcNSpexPJCCWhc5stEt gKsqBLOWDKoZcDjibCu6Ha8bs4qKEfv/1EozCtshWTBjW1eJewCUnvcx X-Gm-Gg: AfdE7clKORPKnJZeC7DJ6zvXqkWhZ9nkNgdPQvykqffnLLGeeknLnpkDX0SXhCB8PuP uVy7FDYNl1f1U1IYXFrqe9wdIL1a22TRR4YmdtAHjD7SPl5sW1PWMZNpvJRXB5Ct3mJpIfpc9Q2 TCqPnzow2qx7xVct4AoLK6McSPrRPO819kaeOaey/zItnOnMvM5bQ9BGiarxN5xRStwJ9GyykNZ D7o2U46PIGUZvAvf5sGZMZk0ivN0Av1OGkQFJ6AIKRQgnDI9PyUnxA8nHQBItmHzoyffwKaFzBf Vot5ocSmq/2QQ3CER/Wuc7tQ87UGrRq2QRh5Znc+kZOIrFUMWSfAycaYUk2sm4zPvDyHQStOgi6 M0WT2VUet1SQ/l37cSlZaRju5D/A+etsMK6St8zWQazCw3Q5Jf+oQ/QQOtUIlI09AksxfOBY/pZ stmUCGf7PTYoNeBrCyyNyw4rjQ3VQRxi3vP2bb X-Received: by 2002:a05:6000:4286:b0:45e:e9ac:42e8 with SMTP id ffacd0b85a97d-46dc0839ffbmr20802510f8f.18.1782640617140; Sun, 28 Jun 2026 02:56:57 -0700 (PDT) Received: from Dev-Null-MSI ([2a0d:3344:52ac:a808:98a4:4381:be45:536f]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47327c47122sm2959694f8f.34.2026.06.28.02.56.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 28 Jun 2026 02:56:56 -0700 (PDT) From: Yousef Alhouseen To: Konstantin Komarov Cc: ntfs3@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org, syzbot+45ef5a8d661162757547@syzkaller.appspotmail.com, Yousef Alhouseen Subject: [PATCH] ntfs3: bound index head insertions by buffer capacity Date: Sun, 28 Jun 2026 11:55:59 +0200 Message-ID: <20260628095559.47891-1-alhouseenyousef@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit hdr_insert_head() shifts the existing index entries by ins_bytes without checking that the resulting used size fits within hdr->total. A directory index root larger than the newly allocated index buffer can therefore make the memmove write beyond the buffer. Reject insertions whose size would exceed the index header capacity and make both split callers unwind the new node when that happens. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Reported-by: syzbot+45ef5a8d661162757547@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=45ef5a8d661162757547 Cc: stable@vger.kernel.org Signed-off-by: Yousef Alhouseen --- fs/ntfs3/index.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 5344b29b0577..64e1be9b7aca 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -594,6 +594,8 @@ static const struct NTFS_DE *hdr_insert_head(struct INDEX_HDR *hdr, if (!e) return NULL; + if (size_add(used, ins_bytes) > le32_to_cpu(hdr->total)) + return NULL; /* Now we just make room for the inserted entries and jam it in. */ to_move = used - le32_to_cpu(hdr->de_off); @@ -1743,7 +1745,10 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni, hdr_total = le32_to_cpu(hdr->total); /* Copy root entries into new buffer. */ - hdr_insert_head(hdr, re, to_move); + if (!hdr_insert_head(hdr, re, to_move)) { + err = -EINVAL; + goto out_put_n; + } /* Update bitmap attribute. */ indx_mark_used(indx, ni, new_vbn >> indx->idx2vbn_bits); @@ -1881,7 +1886,11 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni, /* Copy all the entries <= sp into the new buffer. */ de_t = hdr_first_de(hdr1); to_copy = PtrOffset(de_t, sp); - hdr_insert_head(hdr2, de_t, to_copy); + if (!hdr_insert_head(hdr2, de_t, to_copy)) { + err = -EINVAL; + put_indx_node(n2); + goto out; + } /* Remove all entries (sp including) from hdr1. */ used = used1 - to_copy - sp_size; -- 2.54.0