From nobody Tue Jun 30 09:23:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25F97C433EF for ; Thu, 20 Jan 2022 10:01:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359716AbiATKBD (ORCPT ); Thu, 20 Jan 2022 05:01:03 -0500 Received: from hust.edu.cn ([202.114.0.240]:6359 "EHLO hust.edu.cn" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S238429AbiATKBB (ORCPT ); Thu, 20 Jan 2022 05:01:01 -0500 X-Greylist: delayed 615 seconds by postgrey-1.27 at vger.kernel.org; Thu, 20 Jan 2022 05:01:01 EST Received: from localhost.localdomain ([172.16.0.254]) (user=dzm91@hust.edu.cn mech=LOGIN bits=0) by mx1.hust.edu.cn with ESMTP id 20K9nKP2008038-20K9nKP5008038 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 20 Jan 2022 17:49:31 +0800 From: Dongliang Mu To: Anton Altaparmakov Cc: Dongliang Mu , syzbot+3c765c5248797356edaa@syzkaller.appspotmail.com, linux-ntfs-dev@lists.sourceforge.net, linux-kernel@vger.kernel.org Subject: [PATCH] ntfs: add sanity check on allocation size Date: Thu, 20 Jan 2022 17:49:14 +0800 Message-Id: <20220120094914.47736-1-dzm91@hust.edu.cn> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-FEAS-AUTH-USER: dzm91@hust.edu.cn Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dongliang Mu ntfs_read_inode_mount invokes ntfs_malloc_nofs with zero allocation size. I= t triggers one BUG in the __ntfs_malloc function. Fix this by adding sanity check on ni->attr_list_size. Reported-by: syzbot+3c765c5248797356edaa@syzkaller.appspotmail.com Signed-off-by: Dongliang Mu --- fs/ntfs/inode.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c index 4474adb393ca..517b71c73aa9 100644 --- a/fs/ntfs/inode.c +++ b/fs/ntfs/inode.c @@ -1881,6 +1881,10 @@ int ntfs_read_inode_mount(struct inode *vi) } /* Now allocate memory for the attribute list. */ ni->attr_list_size =3D (u32)ntfs_attr_size(a); + if (!ni->attr_list_size) { + ntfs_error(sb, "Attr_list_size is zero"); + goto put_err_out; + } ni->attr_list =3D ntfs_malloc_nofs(ni->attr_list_size); if (!ni->attr_list) { ntfs_error(sb, "Not enough memory to allocate buffer " --=20 2.25.1