Forwarded: [PATCH] hpfs: add buffer bounds validation in hpfs_bplus_lookup

[syzbot <syzbot+8debf4b3f7c7391cd8eb@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] hpfs: add buffer bounds validation in hpfs_bplus_lookup
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

When traversing the B+ tree in a corrupted HPFS filesystem, the btree
pointer obtained from GET_BTREE_PTR() may point outside the mapped
buffer's bounds if the on-disk data structures are malformed. This
leads to a use-after-free when accessing btree->u.external[i] as the
memory may have been freed and reallocated.

Additionally, a corrupted n_used_nodes value can cause out-of-bounds
array access when iterating through btree->u.internal[] or
btree->u.external[] arrays.

Add validation to ensure:
1. The btree pointer stays within the mapped buffer boundaries
2. The n_used_nodes value is within reasonable limits

This prevents KASAN-detected use-after-free when processing malicious
HPFS filesystem images.

Reported-by: syzbot+8debf4b3f7c7391cd8eb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8debf4b3f7c7391cd8eb
---
 fs/hpfs/anode.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/fs/hpfs/anode.c b/fs/hpfs/anode.c
index a4f5321eafae..7324ec22941a 100644
--- a/fs/hpfs/anode.c
+++ b/fs/hpfs/anode.c
@@ -28,6 +28,18 @@ secno hpfs_bplus_lookup(struct super_block *s, struct inode *inode,
 				brelse(bh);
 				if (!(anode = hpfs_map_anode(s, a, &bh))) return -1;
 				btree = GET_BTREE_PTR(&anode->btree);
+				if ((void *)btree < (void *)bh->b_data ||
+				    (void *)btree + sizeof(*btree) > (void *)bh->b_data + bh->b_size) {
+					hpfs_error(s, "btree pointer out of bounds");
+					brelse(bh);
+					return -1;
+				}
+
+				if (btree->n_used_nodes > 60) {
+					hpfs_error(s, "n_used_nodes=%u is suspiciously large", btree->n_used_nodes);
+					brelse(bh);
+					return -1;
+				}
 				goto go_down;
 			}
 		hpfs_error(s, "sector %08x not found in internal anode %08x", sec, a);
-- 
2.43.0