Patch "fs/ntfs3: Fix an NULL dereference bug" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    fs/ntfs3: Fix an NULL dereference bug

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     fs-ntfs3-fix-an-null-dereference-bug.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 60c361e2e5795ef46db387c85e12f05796aec633
Author: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date:   Tue Oct 17 17:04:39 2023 +0300

    fs/ntfs3: Fix an NULL dereference bug
    
    [ Upstream commit b2dd7b953c25ffd5912dda17e980e7168bebcf6c ]
    
    The issue here is when this is called from ntfs_load_attr_list().  The
    "size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow
    on a 64bit systems but on 32bit systems the "+ 1023" can overflow and
    the result is zero.  This means that the kmalloc will succeed by
    returning the ZERO_SIZE_PTR and then the memcpy() will crash with an
    Oops on the next line.
    
    Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations")
    Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    Signed-off-by: Konstantin Komarov <almaz.alexandrovich@xxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
index 8c9abaf139e6..74482ef569ab 100644
--- a/fs/ntfs3/ntfs_fs.h
+++ b/fs/ntfs3/ntfs_fs.h
@@ -467,7 +467,7 @@ bool al_delete_le(struct ntfs_inode *ni, enum ATTR_TYPE type, CLST vcn,
 int al_update(struct ntfs_inode *ni, int sync);
 static inline size_t al_aligned(size_t size)
 {
-	return (size + 1023) & ~(size_t)1023;
+	return size_add(size, 1023) & ~(size_t)1023;
 }
 
 /* Globals from bitfunc.c */




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux