diff options
| author | Rustam Kovhaev <rkovhaev@gmail.com> | 2020-10-13 16:48:17 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-10-29 09:03:09 +0100 |
| commit | 76e94ac0d60decb21059a68108f16c8d9ac0b43c (patch) | |
| tree | 01612346f73b221580f714d76b384b082a8b0434 | |
| parent | 137571eab26bea7b6fbec7735e393341dacdb754 (diff) | |
| download | linux-stable-76e94ac0d60decb21059a68108f16c8d9ac0b43c.tar.gz linux-stable-76e94ac0d60decb21059a68108f16c8d9ac0b43c.tar.bz2 linux-stable-76e94ac0d60decb21059a68108f16c8d9ac0b43c.zip | |
ntfs: add check for mft record size in superblock
[ Upstream commit 4f8c94022f0bc3babd0a124c0a7dcdd7547bd94e ]
Number of bytes allocated for mft record should be equal to the mft record
size stored in ntfs superblock as reported by syzbot, userspace might
trigger out-of-bounds read by dereferencing ctx->attr in ntfs_attr_find()
Reported-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com
Acked-by: Anton Altaparmakov <anton@tuxera.com>
Link: https://syzkaller.appspot.com/bug?extid=aed06913f36eff9b544e
Link: https://lkml.kernel.org/r/20200824022804.226242-1-rkovhaev@gmail.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/ntfs/inode.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c index d284f07eda77..38260c07de8b 100644 --- a/fs/ntfs/inode.c +++ b/fs/ntfs/inode.c @@ -1844,6 +1844,12 @@ int ntfs_read_inode_mount(struct inode *vi) brelse(bh); } + if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) { + ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.", + le32_to_cpu(m->bytes_allocated), vol->mft_record_size); + goto err_out; + } + /* Apply the mst fixups. */ if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) { /* FIXME: Try to use the $MFTMirr now. */ |