Re: [PATCH] adfs: validate nzones in adfs_read_map()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Fri, Mar 20, 2026 at 02:37:15PM +0000, Russell King (Oracle) wrote:
> On Fri, Mar 20, 2026 at 03:23:56PM +0100, Greg Kroah-Hartman wrote:
> > From: Bae Yeonju <iwasbaeyz@gmail.com>
> > 
> > adfs_read_map() reads the zone count from the on-disk disc record
> > without validation:
> > 
> >   nzones = dr->nzones | dr->nzones_high << 8;
> > 
> > When nzones is 0, the subsequent kmalloc_array(0, ...) returns
> > ZERO_SIZE_PTR (0x10), and adfs_map_layout() writes to dm[-1],
> > causing an out-of-bounds write before the allocated buffer.
> > 
> > This can be triggered by mounting a crafted ADFS filesystem image
> > with nzones set to 0 in the disc record. It leads to kernel heap
> > corruption and a NULL pointer dereference during mount.
> > 
> > Add a check to reject disc records with nzones == 0 before the
> > allocation.
> > 
> > Found by syzkaller.
> 
> I didn't see this patch.

This is the first time it has been sent in public.

> This is a silly place to put the check - it should be done while
> validating the disc record, in adfs_validate_bblk(), not when trying
> to use it.
> 
> Note that adfs_validate_dr0() already validates the number of zones.

But then why is this check also needed?  I'm all for moving it
elsewhere, Bae has the reproducer, they can check if moving it fixes
their issue or not.

thanks,

greg k-h