[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <68e58b9a.050a0220.256323.0027.GAE@google.com>
Date: Tue, 07 Oct 2025 14:52:26 -0700
From: syzbot <syzbot+3a1878433bc1cb97b42a@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded:
For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.
***
Subject:
Author: jkoolstra@...all.nl
#syz test
fs/ntfs3/index.c | 10 +++++-----
fs/ntfs3/ntfs.h | 5 ++++-
2 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 6d1bf890929d..2e512abc7000 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1808,7 +1808,7 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
CLST new_vbn;
__le64 t_vbn, *sub_vbn;
u16 sp_size;
- void *hdr1_saved = NULL;
+ void *blk1_saved = NULL;
/* Try the most easy case. */
e = fnd->level - 1 == level ? fnd->de[level] : NULL;
@@ -1842,8 +1842,8 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
memcpy(up_e, sp, sp_size);
used1 = le32_to_cpu(hdr1->used);
- hdr1_saved = kmemdup(hdr1, used1, GFP_NOFS);
- if (!hdr1_saved) {
+ blk1_saved = kmemdup(&n1->index->blk, used1, GFP_NOFS);
+ if (!blk1_saved) {
err = -ENOMEM;
goto out;
}
@@ -1924,13 +1924,13 @@ indx_insert_into_buffer(struct ntfs_index *indx, struct ntfs_inode *ni,
* Undo critical operations.
*/
indx_mark_free(indx, ni, new_vbn >> indx->idx2vbn_bits);
- memcpy(hdr1, hdr1_saved, used1);
+ memcpy(&n1->index->blk, blk1_saved, used1);
indx_write(indx, ni, n1, 0);
}
out:
kfree(up_e);
- kfree(hdr1_saved);
+ kfree(blk1_saved);
return err;
}
diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h
index 552b97905813..d5e2b22eacd7 100644
--- a/fs/ntfs3/ntfs.h
+++ b/fs/ntfs3/ntfs.h
@@ -754,7 +754,10 @@ static inline bool hdr_has_subnode(const struct INDEX_HDR *hdr)
struct INDEX_BUFFER {
struct NTFS_RECORD_HEADER rhdr; // 'INDX'
__le64 vbn; // 0x10: vcn if index >= cluster or vsn id index < cluster
- struct INDEX_HDR ihdr; // 0x18:
+ struct_group(blk,
+ struct INDEX_HDR ihdr; // 0x18:
+ u8 data[]; // NTFS_DE entries
+ );
};
static_assert(sizeof(struct INDEX_BUFFER) == 0x28);
--
2.51.0
Powered by blists - more mailing lists