| From 0f1be3592e6cd49bffde5a999cca0da4c2e74457 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 6 Jun 2025 13:16:16 +0800 |
| Subject: fs/ntfs3: Add sanity check for file name |
| |
| From: Lizhi Xu <lizhi.xu@windriver.com> |
| |
| [ Upstream commit e841ecb139339602bc1853f5f09daa5d1ea920a2 ] |
| |
| The length of the file name should be smaller than the directory entry size. |
| |
| Reported-by: syzbot+598057afa0f49e62bd23@syzkaller.appspotmail.com |
| Closes: https://syzkaller.appspot.com/bug?extid=598057afa0f49e62bd23 |
| Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com> |
| Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| fs/ntfs3/dir.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c |
| index a4ab0164d150..c49e64ebbd0a 100644 |
| --- a/fs/ntfs3/dir.c |
| +++ b/fs/ntfs3/dir.c |
| @@ -304,6 +304,9 @@ static inline bool ntfs_dir_emit(struct ntfs_sb_info *sbi, |
| if (sbi->options->nohidden && (fname->dup.fa & FILE_ATTRIBUTE_HIDDEN)) |
| return true; |
| |
| + if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size)) |
| + return true; |
| + |
| name_len = ntfs_utf16_to_nls(sbi, fname->name, fname->name_len, name, |
| PATH_MAX); |
| if (name_len <= 0) { |
| -- |
| 2.39.5 |
| |
