mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Manas Ghandat <ghandatmanas@gmail.com>
To: anton@tuxera.com, linkinjeon@kernel.org,
	syzbot+ef50f8eb00b54feb7ba2@syzkaller.appspotmail.com
Cc: linux-ntfs-dev@lists.sourceforge.net,
	linux-kernel@vger.kernel.org,
	Linux-kernel-mentees@lists.linuxfoundation.org
Subject: fs/ntfs : use-after-free Read in ntfs_attr_find
Date: Tue, 22 Aug 2023 23:14:46 +0530	[thread overview]
Message-ID: <f2b664d5-0710-67ae-fda8-d407af4df6fe@gmail.com> (raw)

Hi,

I was looking at this syzbot issue : 
https://syzkaller.appspot.com/bug?extid=ef50f8eb00b54feb7ba2

While debugging I found that when we are traversing through the 
attribute list, there is case when the next attribute is null (most 
likely we are traversing out of the list) and thus there is this error. 
I was wondering if we could add a size field to this attribute list. 
This would fix this issue. Currently we are just parsing to the next 
attribute using the length field.



                 reply	other threads:[~2023-08-22 17:44 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=f2b664d5-0710-67ae-fda8-d407af4df6fe@gmail.com \
    --to=ghandatmanas@gmail.com \
    --cc=000000000000aefc5005f5df169b@google.com \
    --cc=Linux-kernel-mentees@lists.linuxfoundation.org \
    --cc=anton@tuxera.com \
    --cc=linkinjeon@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-ntfs-dev@lists.sourceforge.net \
    --cc=syzbot+ef50f8eb00b54feb7ba2@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®