* + ntfs-add-check-for-mft-record-size-in-superblock.patch added to -mm tree
@ 2020-08-24 20:02 akpm
0 siblings, 0 replies; only message in thread
From: akpm @ 2020-08-24 20:02 UTC (permalink / raw)
To: anton, mm-commits, rkovhaev
The patch titled
Subject: ntfs: add check for mft record size in superblock
has been added to the -mm tree. Its filename is
ntfs-add-check-for-mft-record-size-in-superblock.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/ntfs-add-check-for-mft-record-size-in-superblock.patch
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/ntfs-add-check-for-mft-record-size-in-superblock.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Rustam Kovhaev <rkovhaev@gmail.com>
Subject: ntfs: add check for mft record size in superblock
Number of bytes allocated for mft record should be equal to the mft record
size stored in ntfs superblock as reported by syzbot, userspace might
trigger out-of-bounds read by dereferencing ctx->attr in ntfs_attr_find()
Link: https://syzkaller.appspot.com/bug?extid=aed06913f36eff9b544e
Link: https://lkml.kernel.org/r/20200824022804.226242-1-rkovhaev@gmail.com
Reported-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com
Tested-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Acked-by: Anton Altaparmakov <anton@tuxera.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
fs/ntfs/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ntfs/inode.c~ntfs-add-check-for-mft-record-size-in-superblock
+++ a/fs/ntfs/inode.c
@@ -1810,6 +1810,12 @@ int ntfs_read_inode_mount(struct inode *
brelse(bh);
}
+ if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) {
+ ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.",
+ le32_to_cpu(m->bytes_allocated), vol->mft_record_size);
+ goto err_out;
+ }
+
/* Apply the mst fixups. */
if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) {
/* FIXME: Try to use the $MFTMirr now. */
_
Patches currently in -mm which might be from rkovhaev@gmail.com are
scripts-tagssh-exclude-tools-directory-from-tags-generation.patch
ntfs-add-check-for-mft-record-size-in-superblock.patch
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-08-24 20:02 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-24 20:02 + ntfs-add-check-for-mft-record-size-in-superblock.patch added to -mm tree akpm
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.