Patch "ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f6b6203b8a9f0b4278b32ba610295fe25f2990e6
Author: Zeng Heng <zengheng4@xxxxxxxxxx>
Date:   Thu Dec 8 00:28:07 2022 +0800

    ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()
    
    [ Upstream commit 3c675ddffb17a8b1e32efad5c983254af18b12c2 ]
    
    Here is a BUG report from syzbot:
    
    BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline]
    BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710
    Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632
    
    Call Trace:
     ntfs_list_ea fs/ntfs3/xattr.c:191 [inline]
     ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710
     vfs_listxattr fs/xattr.c:457 [inline]
     listxattr+0x293/0x2d0 fs/xattr.c:804
    
    Fix the logic of ea_all iteration. When the ea->name_len is 0,
    return immediately, or Add2Ptr() would visit invalid memory
    in the next loop.
    
    Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations")
    Reported-by: syzbot+9fcea5ef6dc4dc72d334@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Zeng Heng <zengheng4@xxxxxxxxxx>
    [almaz.alexandrovich@xxxxxxxxxxxxxxxxxxxx: lines of the patch have changed]
    Signed-off-by: Konstantin Komarov <almaz.alexandrovich@xxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
index 8847db0159084..63250a5aae0aa 100644
--- a/fs/ntfs3/xattr.c
+++ b/fs/ntfs3/xattr.c
@@ -178,6 +178,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer,
 	for (ret = 0, off = 0; off < size; off += unpacked_ea_size(ea)) {
 		ea = Add2Ptr(ea_all, off);
 
+		if (!ea->name_len)
+			break;
+
 		if (buffer) {
 			if (ret + ea->name_len + 1 > bytes_per_buffer) {
 				err = -ERANGE;