shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 02:21:52 +09:00
Code Issues Packages Projects Releases Wiki Activity

fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super

Browse Source 
commit 91a4b1ee78 upstream.

Reported-by: syzbot+478c1bf0e6bf4a8f3a04@syzkaller.appspotmail.com
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Miguel Garcia Roman <miguelgarciaroman8@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Konstantin Komarov
2023-06-30 16:25:25 +04:00
committed by Greg Kroah-Hartman
parent 4c3712c15f
commit f9c572d02f
2 changed files with 48 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
fs/ntfs3/ntfs_fs.h
View File

@@ -42,9 +42,11 @@ enum utf16_endian;
#define MINUS_ONE_T ((size_t)(-1))
/* Biggest MFT / smallest cluster */
#define MAXIMUM_BYTES_PER_MFT 4096
#define MAXIMUM_SHIFT_BYTES_PER_MFT 12
#define NTFS_BLOCKS_PER_MFT_RECORD (MAXIMUM_BYTES_PER_MFT / 512)
#define MAXIMUM_BYTES_PER_INDEX 4096
#define MAXIMUM_SHIFT_BYTES_PER_INDEX 12
#define NTFS_BLOCKS_PER_INODE (MAXIMUM_BYTES_PER_INDEX / 512)
/* NTFS specific error code when fixup failed. */

68
fs/ntfs3/super.c
View File

@@ -680,7 +680,7 @@ static u32 true_sectors_per_clst(const struct NTFS_BOOT *boot)
* ntfs_init_from_boot - Init internal info from on-disk boot sector.
*/
static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
u64 dev_size)
u64 dev_size)
{
struct ntfs_sb_info *sbi = sb->s_fs_info;
int err;
@@ -705,12 +705,12 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
/* 0x55AA is not mandaroty. Thanks Maxim Suhanov*/
/*if (0x55 != boot->boot_magic[0] || 0xAA != boot->boot_magic[1])
* goto out;
* goto out;
*/
boot_sector_size = (u32)boot->bytes_per_sector[1] << 8;
if (boot->bytes_per_sector[0] || boot_sector_size < SECTOR_SIZE ||
!is_power_of_2(boot_sector_size)) {
!is_power_of_2(boot_sector_size)) {
goto out;
}
@@ -733,15 +733,49 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
/* Check MFT record size. */
if ((boot->record_size < 0 &&
SECTOR_SIZE > (2U << (-boot->record_size))) ||
(boot->record_size >= 0 && !is_power_of_2(boot->record_size))) {
SECTOR_SIZE > (2U << (-boot->record_size))) ||
(boot->record_size >= 0 && !is_power_of_2(boot->record_size))) {
goto out;
}
/* Calculate cluster size */
sbi->cluster_size = boot_sector_size * sct_per_clst;
sbi->cluster_bits = blksize_bits(sbi->cluster_size);
if (boot->record_size >= 0) {
record_size = (u32)boot->record_size << sbi->cluster_bits;
} else if (-boot->record_size <= MAXIMUM_SHIFT_BYTES_PER_MFT) {
record_size = 1u << (-boot->record_size);
} else {
ntfs_err(sb, "%s: invalid record size %d.", "NTFS",
boot->record_size);
goto out;
}
sbi->record_size = record_size;
sbi->record_bits = blksize_bits(record_size);
sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes
if (record_size > MAXIMUM_BYTES_PER_MFT) {
ntfs_err(sb, "Unsupported bytes per MFT record %u.",
record_size);
goto out;
}
if (boot->index_size >= 0) {
sbi->index_size = (u32)boot->index_size << sbi->cluster_bits;
} else if (-boot->index_size <= MAXIMUM_SHIFT_BYTES_PER_INDEX) {
sbi->index_size = 1u << (-boot->index_size);
} else {
ntfs_err(sb, "%s: invalid index size %d.", "NTFS",
boot->index_size);
goto out;
}
/* Check index record size. */
if ((boot->index_size < 0 &&
SECTOR_SIZE > (2U << (-boot->index_size))) ||
(boot->index_size >= 0 && !is_power_of_2(boot->index_size))) {
SECTOR_SIZE > (2U << (-boot->index_size))) ||
(boot->index_size >= 0 && !is_power_of_2(boot->index_size))) {
goto out;
}
@@ -762,9 +796,6 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
dev_size += sector_size - 1;
}
sbi->cluster_size = boot_sector_size * sct_per_clst;
sbi->cluster_bits = blksize_bits(sbi->cluster_size);
sbi->mft.lbo = mlcn << sbi->cluster_bits;
sbi->mft.lbo2 = mlcn2 << sbi->cluster_bits;
@@ -785,9 +816,9 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
sbi->cluster_mask = sbi->cluster_size - 1;
sbi->cluster_mask_inv = ~(u64)sbi->cluster_mask;
sbi->record_size = record_size = boot->record_size < 0
? 1 << (-boot->record_size)
: (u32)boot->record_size
<< sbi->cluster_bits;
? 1 << (-boot->record_size)
: (u32)boot->record_size
<< sbi->cluster_bits;
if (record_size > MAXIMUM_BYTES_PER_MFT || record_size < SECTOR_SIZE)
goto out;
@@ -801,8 +832,8 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
ALIGN(sizeof(enum ATTR_TYPE), 8);
sbi->index_size = boot->index_size < 0
? 1u << (-boot->index_size)
: (u32)boot->index_size << sbi->cluster_bits;
? 1u << (-boot->index_size)
: (u32)boot->index_size << sbi->cluster_bits;
sbi->volume.ser_num = le64_to_cpu(boot->serial_num);
@@ -871,13 +902,6 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
sb->s_maxbytes = 0xFFFFFFFFull << sbi->cluster_bits;
#endif
/*
* Compute the MFT zone at two steps.
* It would be nice if we are able to allocate 1/8 of
* total clusters for MFT but not more then 512 MB.
*/
sbi->zone_max = min_t(CLST, 0x20000000 >> sbi->cluster_bits, clusters >> 3);
err = 0;
out: