adfs_fplus_getnext() reads the entry name length (bigdirobnamelen, u32) from disk and passes it to adfs_dir_copyfrom() as the length to copy into the fixed 260-byte on-stack obj->name buffer. adfs_dir_copyfrom() bounds only the source, so a crafted F+ directory entry overflows the stack (KASAN: stack-out-of-bounds, write; stack-protector panic), reachable from a mounted crafted ADFS image by a readdir (ls). Reject an entry whose name does not fit in obj->name, leaving room for the optional ",xyz" filetype suffix appended by adfs_object_fixup(). Signed-off-by: Marouane El Moufid --- fs/adfs/dir_fplus.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/adfs/dir_fplus.c b/fs/adfs/dir_fplus.c --- a/fs/adfs/dir_fplus.c +++ b/fs/adfs/dir_fplus.c @@ -192,6 +192,8 @@ obj->indaddr = le32_to_cpu(bde.bigdirindaddr); obj->attr = le32_to_cpu(bde.bigdirattr); obj->name_len = le32_to_cpu(bde.bigdirobnamelen); + if (obj->name_len > ADFS_MAX_NAME_LEN - 4) + return -EINVAL; offset = adfs_fplus_offset(h, le32_to_cpu(h->bigdirentries)); offset += le32_to_cpu(bde.bigdirobnameptr);