linux-kernel - Forwarded: [PATCH] hpfs: add buffer bounds validation in hpfs_bplus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <696b05dc.050a0220.3390f1.0002.GAE@google.com>
Date: Fri, 16 Jan 2026 19:45:32 -0800
From: syzbot <syzbot+8debf4b3f7c7391cd8eb@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] hpfs: add buffer bounds validation in hpfs_bplus_lookup

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] hpfs: add buffer bounds validation in hpfs_bplus_lookup
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

When traversing the B+ tree in a corrupted HPFS filesystem, the btree
pointer obtained from GET_BTREE_PTR() may point outside the mapped
buffer's bounds if the on-disk data structures are malformed. This
leads to a use-after-free when accessing btree->u.external[i] as the
memory may have been freed and reallocated.

Additionally, a corrupted n_used_nodes value can cause out-of-bounds
array access when iterating through btree->u.internal[] or
btree->u.external[] arrays.

Add validation to ensure:
1. The btree pointer stays within the mapped buffer boundaries
2. The n_used_nodes value is within reasonable limits

This prevents KASAN-detected use-after-free when processing malicious
HPFS filesystem images.

Reported-by: syzbot+8debf4b3f7c7391cd8eb@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8debf4b3f7c7391cd8eb
---
 fs/hpfs/anode.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/fs/hpfs/anode.c b/fs/hpfs/anode.c
index a4f5321eafae..7324ec22941a 100644
--- a/fs/hpfs/anode.c
+++ b/fs/hpfs/anode.c
@@ -28,6 +28,18 @@ secno hpfs_bplus_lookup(struct super_block *s, struct inode *inode,
 				brelse(bh);
 				if (!(anode = hpfs_map_anode(s, a, &bh))) return -1;
 				btree = GET_BTREE_PTR(&anode->btree);
+				if ((void *)btree < (void *)bh->b_data ||
+				    (void *)btree + sizeof(*btree) > (void *)bh->b_data + bh->b_size) {
+					hpfs_error(s, "btree pointer out of bounds");
+					brelse(bh);
+					return -1;
+				}
+
+				if (btree->n_used_nodes > 60) {
+					hpfs_error(s, "n_used_nodes=%u is suspiciously large", btree->n_used_nodes);
+					brelse(bh);
+					return -1;
+				}
 				goto go_down;
 			}
 		hpfs_error(s, "sector %08x not found in internal anode %08x", sec, a);
-- 
2.43.0