Re: [PATCH v2] adfs: validate nzones in adfs_validate_bblk()

["Russell King (Oracle)" <linux@armlinux.org.uk>]

On Fri, Mar 20, 2026 at 05:04:07PM +0100, Greg KH wrote:
> On Sat, Mar 21, 2026 at 12:52:13AM +0900, paeyz wrote:
> > From: Bae Yeonju <iwasbaeyz@gmail.com>
> > 
> > Reject ADFS disc records with a zero zone count during boot block
> > validation, before the disc record is used.
> > 
> > When nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...)
> > which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to
> > dm[-1], causing an out-of-bounds write before the allocated buffer.
> > 
> > adfs_validate_dr0() already rejects nzones != 1 for old-format
> > images.  Add the equivalent check to adfs_validate_bblk() for
> > new-format images so that a crafted image with nzones == 0 is
> > rejected at probe time.
> > 
> > Found by syzkaller.
> > 
> > Fixes: f6f14a0d71b0 ("fs/adfs: map: move map-specific sb initialisation to map.c")
> > Tested-by: Bae Yeonju <iwasbaeyz@gmail.com>
> > Signed-off-by: Bae Yeonju <iwasbaeyz@gmail.com>
> 
> Nit, no need for Tested-by if you sign off on the change :)
> 
> > ---
> >  fs/adfs/super.c | 3 +++
> >  1 file changed, 3 insertions(+)
> 
> The version info from what changed goes below the --- line.
> 
> Anyway, who takes adfs changes these days?  Russell do you?  There's no
> MAINTAINERS entry that I can find.  If no one else, I can take it
> through one of my trees.

I have done, as I'm the author of this fs driver.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!