Forwarded: Re: [syzbot] KASAN: slab-out-of-bounds in decompress_lznt

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: Re: [syzbot] KASAN: slab-out-of-bounds in decompress_lznt
Author: tristmd@xxxxxxxxx

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>From 6cfb2c5508cbe3c057fc4fe83808ef6cf8fc9868 Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 17 Apr 2026 16:15:16 +0000
Subject: [PATCH] ntfs3: fix array-index-out-of-bounds in decompress_lznt
decompress_chunk() increments index without checking array bounds,
leading to an out-of-bounds access on s_max_off when processing
corrupted compressed data.
Add an upper bound check on index to prevent the overflow.
Reported-by: syzbot+39b2fb0f2638669008ec@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=39b2fb0f2638669008ec
Signed-off-by: Tristan Madani <tristan@xxxxxxxxxxxxxxxxxxx>
---
 fs/ntfs3/lznt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/lznt.c b/fs/ntfs3/lznt.c
index fdc9b2e..f818d97 100644
--- a/fs/ntfs3/lznt.c
+++ b/fs/ntfs3/lznt.c
@@ -240,7 +240,7 @@ static inline ssize_t decompress_chunk(u8 *unc, u8 *unc_end, const u8 *cmpr,
 		if (up - unc > LZNT_CHUNK_SIZE)
 			return -EINVAL;
 		/* Correct index */
-		while (unc + s_max_off[index] < up)
+		while (index < ARRAY_SIZE(s_max_off) - 1 && unc + s_max_off[index] < up)
 			index += 1;
 
 		/* Check the current flag for zero. */
-- 
2.47.3