Commit 4f8c9402 authored by Rustam Kovhaev's avatar Rustam Kovhaev Committed by Linus Torvalds
Browse files

ntfs: add check for mft record size in superblock 



Number of bytes allocated for mft record should be equal to the mft record
size stored in ntfs superblock as reported by syzbot, userspace might
trigger out-of-bounds read by dereferencing ctx->attr in ntfs_attr_find()

Reported-by: default avatar <syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com>
Signed-off-by: default avatarRustam Kovhaev <rkovhaev@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Tested-by: default avatar <syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com>
Acked-by: default avatarAnton Altaparmakov <anton@tuxera.com>
Link: https://syzkaller.appspot.com/bug?extid=aed06913f36eff9b544e
Link: https://lkml.kernel.org/r/20200824022804.226242-1-rkovhaev@gmail.com


Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent d72e720a

fs/ntfs/inode.c

+6 −0
Original line number Diff line number Diff line
@@ -1810,6 +1810,12 @@ int ntfs_read_inode_mount(struct inode *vi) 
		brelse(bh);

	}



	if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) {

		ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.",

				le32_to_cpu(m->bytes_allocated), vol->mft_record_size);

		goto err_out;

	}



	/* Apply the mst fixups. */

	if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) {

		/* FIXME: Try to use the $MFTMirr now. */

CRA Git | Maintained and supported by SUSTech CRA and CCSE