Re: [PATCH v2] adfs: validate nzones in adfs_validate_bblk()

[Greg KH]

On Fri, Mar 20, 2026 at 04:08:26PM +0000, Russell King (Oracle) wrote:
> On Fri, Mar 20, 2026 at 05:04:07PM +0100, Greg KH wrote:
> > On Sat, Mar 21, 2026 at 12:52:13AM +0900, paeyz wrote:
> > > From: Bae Yeonju <iwasbaeyz@xxxxxxxxx>
> > > 
> > > Reject ADFS disc records with a zero zone count during boot block
> > > validation, before the disc record is used.
> > > 
> > > When nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...)
> > > which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to
> > > dm[-1], causing an out-of-bounds write before the allocated buffer.
> > > 
> > > adfs_validate_dr0() already rejects nzones != 1 for old-format
> > > images.  Add the equivalent check to adfs_validate_bblk() for
> > > new-format images so that a crafted image with nzones == 0 is
> > > rejected at probe time.
> > > 
> > > Found by syzkaller.
> > > 
> > > Fixes: f6f14a0d71b0 ("fs/adfs: map: move map-specific sb initialisation to map.c")
> > > Tested-by: Bae Yeonju <iwasbaeyz@xxxxxxxxx>
> > > Signed-off-by: Bae Yeonju <iwasbaeyz@xxxxxxxxx>
> > 
> > Nit, no need for Tested-by if you sign off on the change :)
> > 
> > > ---
> > >  fs/adfs/super.c | 3 +++
> > >  1 file changed, 3 insertions(+)
> > 
> > The version info from what changed goes below the --- line.
> > 
> > Anyway, who takes adfs changes these days?  Russell do you?  There's no
> > MAINTAINERS entry that I can find.  If no one else, I can take it
> > through one of my trees.
> 
> I have done, as I'm the author of this fs driver.

Great, thanks!

Acked-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>