Forwarded: [PATCH] hpfs: add array bounds validation in hpfs_bplus_lookup

[syzbot <syzbot+8debf4b3f7c7391cd8eb@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] hpfs: add array bounds validation in hpfs_bplus_lookup
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


When traversing a corrupted HPFS filesystem, the n_used_nodes field in
the btree header can contain a value larger than what fits in the
allocated buffer. This causes out-of-bounds array access when iterating
through btree->u.internal[] or btree->u.external[] arrays, leading to
a KASAN-detected use-after-free.

Validate that n_used_nodes does not exceed the maximum number of nodes
that can fit in the buffer before accessing the arrays.

Reported-by: syzbot+8debf4b3f7c7391cd8eb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8debf4b3f7c7391cd8eb
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 fs/hpfs/anode.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/fs/hpfs/anode.c b/fs/hpfs/anode.c
index a4f5321eafae..6e1b43f5c9cf 100644
--- a/fs/hpfs/anode.c
+++ b/fs/hpfs/anode.c
@@ -21,6 +22,31 @@ secno hpfs_bplus_lookup(struct super_block *s, struct inode *inode,
 	int c1, c2 = 0;
 	go_down:
 	if (hpfs_sb(s)->sb_chk) if (hpfs_stop_cycles(s, a, &c1, &c2, "hpfs_bplus_lookup")) return -1;
+
+	if (bp_internal(btree)) {
+		unsigned int max_internal_nodes;
+
+		max_internal_nodes = (bh->b_size - ((char *)btree->u.internal - (char *)bh->b_data))
+				      / sizeof(btree->u.internal[0]);
+		if (btree->n_used_nodes > max_internal_nodes) {
+			hpfs_error(s, "btree->n_used_nodes = %u, but max for internal node is %u",
+				   btree->n_used_nodes, max_internal_nodes);
+			brelse(bh);
+			return -1;
+		}
+	} else {
+		unsigned int max_external_nodes;
+
+		max_external_nodes = (bh->b_size - ((char *)btree->u.external - (char *)bh->b_data))
+				     / sizeof(btree->u.external[0]);
+		if (btree->n_used_nodes > max_external_nodes) {
+			hpfs_error(s, "btree->n_used_nodes = %u, but max for external node is %u",
+				   btree->n_used_nodes, max_external_nodes);
+			brelse(bh);
+			return -1;
+		}
+	}
+
 	if (bp_internal(btree)) {
 		for (i = 0; i < btree->n_used_nodes; i++)
 			if (le32_to_cpu(btree->u.internal[i].file_secno) > sec) {
-- 
2.43.0