* [PATCH v2] fs/ntfs3: Fix infinite loop in hdr_find_split due to zero-sized entry [not found] <65bf90b1-8806-4f8c-b7e7-d90193d28e88@web.de> @ 2026-01-18 19:01 ` Jiasheng Jiang 2026-01-19 6:37 ` Greg KH 2026-01-19 9:48 ` Markus Elfring 0 siblings, 2 replies; 3+ messages in thread From: Jiasheng Jiang @ 2026-01-18 19:01 UTC (permalink / raw) To: markus.elfring Cc: almaz.alexandrovich, jiashengjiangcool, linux-kernel, ntfs3, stable The function hdr_find_split iterates over index entries to calculate a split point. The loop increments the offset 'o' by 'esize', which is derived directly from the on-disk 'e->size' field. If a corrupted or malicious filesystem image contains an index entry with a size of 0, the variable 'o' will fail to advance. This results in an infinite loop if the condition 'o < used_2' remains true, causing a kernel hang (Denial of Service). This patch adds a sanity check to ensure 'esize' is at least the size of the NTFS_DE structure, consistent with validation logic in sibling functions like hdr_find_e. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com> --- Changelog: v1 -> v2: 1. Add a Fixes tag. --- fs/ntfs3/index.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 7157cfd70fdc..da6927e6d360 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -577,6 +577,9 @@ static const struct NTFS_DE *hdr_find_split(const struct INDEX_HDR *hdr) return p; esize = le16_to_cpu(e->size); + + if (esize < sizeof(struct NTFS_DE)) + return NULL; } return e; -- 2.25.1 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] fs/ntfs3: Fix infinite loop in hdr_find_split due to zero-sized entry 2026-01-18 19:01 ` [PATCH v2] fs/ntfs3: Fix infinite loop in hdr_find_split due to zero-sized entry Jiasheng Jiang @ 2026-01-19 6:37 ` Greg KH 2026-01-19 9:48 ` Markus Elfring 1 sibling, 0 replies; 3+ messages in thread From: Greg KH @ 2026-01-19 6:37 UTC (permalink / raw) To: Jiasheng Jiang Cc: markus.elfring, almaz.alexandrovich, linux-kernel, ntfs3, stable On Sun, Jan 18, 2026 at 07:01:45PM +0000, Jiasheng Jiang wrote: > The function hdr_find_split iterates over index entries to calculate a > split point. The loop increments the offset 'o' by 'esize', which is > derived directly from the on-disk 'e->size' field. > > If a corrupted or malicious filesystem image contains an index entry > with a size of 0, the variable 'o' will fail to advance. This results > in an infinite loop if the condition 'o < used_2' remains true, causing > a kernel hang (Denial of Service). > > This patch adds a sanity check to ensure 'esize' is at least the size > of the NTFS_DE structure, consistent with validation logic in sibling > functions like hdr_find_e. > > Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") > Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com> > --- > Changelog: > > v1 -> v2: > > 1. Add a Fixes tag. > --- > fs/ntfs3/index.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c > index 7157cfd70fdc..da6927e6d360 100644 > --- a/fs/ntfs3/index.c > +++ b/fs/ntfs3/index.c > @@ -577,6 +577,9 @@ static const struct NTFS_DE *hdr_find_split(const struct INDEX_HDR *hdr) > return p; > > esize = le16_to_cpu(e->size); > + > + if (esize < sizeof(struct NTFS_DE)) > + return NULL; > } > > return e; > -- > 2.25.1 > > <formletter> This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read: https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html for how to do this properly. </formletter> ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] fs/ntfs3: Fix infinite loop in hdr_find_split due to zero-sized entry 2026-01-18 19:01 ` [PATCH v2] fs/ntfs3: Fix infinite loop in hdr_find_split due to zero-sized entry Jiasheng Jiang 2026-01-19 6:37 ` Greg KH @ 2026-01-19 9:48 ` Markus Elfring 1 sibling, 0 replies; 3+ messages in thread From: Markus Elfring @ 2026-01-19 9:48 UTC (permalink / raw) To: Jiasheng Jiang, ntfs3; +Cc: stable, kernel-janitors, LKML, Konstantin Komarov … > This patch adds a sanity check … Thanks for another contribution. * Does anything hinder to follow a corresponding wording requirement? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc5#n94 * Can it be helpful to append parentheses to function names? Regards, Markus ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-01-19 9:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <65bf90b1-8806-4f8c-b7e7-d90193d28e88@web.de>
2026-01-18 19:01 ` [PATCH v2] fs/ntfs3: Fix infinite loop in hdr_find_split due to zero-sized entry Jiasheng Jiang
2026-01-19 6:37 ` Greg KH
2026-01-19 9:48 ` Markus Elfring
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox