Syzkaller reports out of bounds on shift in ntfs_init_from_boot(). The problem was fixed in upstream with patch 91a4b1ee78cb100b19b70f077c247f211110348f. This can be fixed in branch 6.1 with the following patch.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Link: https://syzkaller.appspot.com/bug?extid=010986becd65dbf9464b
Konstantin Komarov (1): fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super
fs/ntfs3/ntfs_fs.h | 2 ++ fs/ntfs3/super.c | 50 +++++++++++++++++++++++++++++----------------- 2 files changed, 34 insertions(+), 18 deletions(-)
From: Konstantin Komarov almaz.alexandrovich@paragon-software.com
commit 91a4b1ee78cb100b19b70f077c247f211110348f upstream.
Reported-by: syzbot+478c1bf0e6bf4a8f3a04@syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov almaz.alexandrovich@paragon-software.com [Roman: added string hint, replaced cluster_bits with sbi->cluster_bits, removed redundant checks near "Check MFT record size" and "Check index record size".] Signed-off-by: Roman Smirnov r.smirnov@omp.ru --- fs/ntfs3/ntfs_fs.h | 2 ++ fs/ntfs3/super.c | 50 +++++++++++++++++++++++++++++----------------- 2 files changed, 34 insertions(+), 18 deletions(-)
diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h index 0f9bec29f2b70..50ae3a6cb3559 100644 --- a/fs/ntfs3/ntfs_fs.h +++ b/fs/ntfs3/ntfs_fs.h @@ -42,9 +42,11 @@ enum utf16_endian; #define MINUS_ONE_T ((size_t)(-1)) /* Biggest MFT / smallest cluster */ #define MAXIMUM_BYTES_PER_MFT 4096 +#define MAXIMUM_SHIFT_BYTES_PER_MFT 12 #define NTFS_BLOCKS_PER_MFT_RECORD (MAXIMUM_BYTES_PER_MFT / 512)
#define MAXIMUM_BYTES_PER_INDEX 4096 +#define MAXIMUM_SHIFT_BYTES_PER_INDEX 12 #define NTFS_BLOCKS_PER_INODE (MAXIMUM_BYTES_PER_INDEX / 512)
/* NTFS specific error code when fixup failed. */ diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index 6066eea3f61cb..863119b6a2a8d 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -690,6 +690,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, struct buffer_head *bh; struct MFT_REC *rec; u16 fn, ao; + const char *hint = "Primary boot";
sbi->volume.blocks = dev_size >> PAGE_SHIFT;
@@ -731,17 +732,24 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, if (mlcn2 * sct_per_clst >= sectors) goto out;
- /* Check MFT record size. */ - if ((boot->record_size < 0 && - SECTOR_SIZE > (2U << (-boot->record_size))) || - (boot->record_size >= 0 && !is_power_of_2(boot->record_size))) { + if (boot->record_size >= 0) { + record_size = (u32)boot->record_size << sbi->cluster_bits; + } else if (-boot->record_size <= MAXIMUM_SHIFT_BYTES_PER_MFT) { + record_size = 1u << (-boot->record_size); + } else { + ntfs_err(sb, "%s: invalid record size %d.", hint, + boot->record_size); goto out; }
- /* Check index record size. */ - if ((boot->index_size < 0 && - SECTOR_SIZE > (2U << (-boot->index_size))) || - (boot->index_size >= 0 && !is_power_of_2(boot->index_size))) { + sbi->record_size = record_size; + sbi->record_bits = blksize_bits(record_size); + sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes + + /* Check MFT record size. */ + if (record_size < SECTOR_SIZE || !is_power_of_2(record_size)) { + ntfs_err(sb, "%s: invalid bytes per MFT record %u (%d).", hint, + record_size, boot->record_size); goto out; }
@@ -784,26 +792,32 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
sbi->cluster_mask = sbi->cluster_size - 1; sbi->cluster_mask_inv = ~(u64)sbi->cluster_mask; - sbi->record_size = record_size = boot->record_size < 0 - ? 1 << (-boot->record_size) - : (u32)boot->record_size - << sbi->cluster_bits;
if (record_size > MAXIMUM_BYTES_PER_MFT || record_size < SECTOR_SIZE) goto out;
- sbi->record_bits = blksize_bits(record_size); - sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes + if (boot->index_size >= 0) { + sbi->index_size = (u32)boot->index_size << sbi->cluster_bits; + } else if (-boot->index_size <= MAXIMUM_SHIFT_BYTES_PER_INDEX) { + sbi->index_size = 1u << (-boot->index_size); + } else { + ntfs_err(sb, "%s: invalid index size %d.", hint, + boot->index_size); + goto out; + } + + /* Check index record size. */ + if (sbi->index_size < SECTOR_SIZE || !is_power_of_2(sbi->index_size)) { + ntfs_err(sb, "%s: invalid bytes per index %u(%d).", hint, + sbi->index_size, boot->index_size); + goto out; + }
sbi->max_bytes_per_attr = record_size - ALIGN(MFTRECORD_FIXUP_OFFSET_1, 8) - ALIGN(((record_size >> SECTOR_SHIFT) * sizeof(short)), 8) - ALIGN(sizeof(enum ATTR_TYPE), 8);
- sbi->index_size = boot->index_size < 0 - ? 1u << (-boot->index_size) - : (u32)boot->index_size << sbi->cluster_bits; - sbi->volume.ser_num = le64_to_cpu(boot->serial_num);
/* Warning if RAW volume. */
linux-stable-mirror@lists.linaro.org
-
Roman Smirnov