summaryrefslogtreecommitdiffstats
path: root/fs/ntfs
diff options
context:
space:
mode:
authorRustam Kovhaev <rkovhaev@gmail.com>2020-10-13 16:48:17 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2020-10-13 18:38:27 -0700
commit4f8c94022f0bc3babd0a124c0a7dcdd7547bd94e (patch)
treef220f6ea642d54e435f5351fe64a3634d56fb7e0 /fs/ntfs
parentd72e720a19393eb611a112e4c5c377785dbd645d (diff)
downloadlinux-4f8c94022f0bc3babd0a124c0a7dcdd7547bd94e.tar.gz
linux-4f8c94022f0bc3babd0a124c0a7dcdd7547bd94e.tar.bz2
linux-4f8c94022f0bc3babd0a124c0a7dcdd7547bd94e.zip
ntfs: add check for mft record size in superblock
Number of bytes allocated for mft record should be equal to the mft record size stored in ntfs superblock as reported by syzbot, userspace might trigger out-of-bounds read by dereferencing ctx->attr in ntfs_attr_find() Reported-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Tested-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com Acked-by: Anton Altaparmakov <anton@tuxera.com> Link: https://syzkaller.appspot.com/bug?extid=aed06913f36eff9b544e Link: https://lkml.kernel.org/r/20200824022804.226242-1-rkovhaev@gmail.com Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/ntfs')
-rw-r--r--fs/ntfs/inode.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index 9bb9f0952b18..caf563981532 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -1810,6 +1810,12 @@ int ntfs_read_inode_mount(struct inode *vi)
brelse(bh);
}
+ if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) {
+ ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.",
+ le32_to_cpu(m->bytes_allocated), vol->mft_record_size);
+ goto err_out;
+ }
+
/* Apply the mst fixups. */
if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) {
/* FIXME: Try to use the $MFTMirr now. */