The patch titled
Subject: ntfs: add check for mft record size in superblock
has been removed from the -mm tree. Its filename was
ntfs-add-check-for-mft-record-size-in-superblock.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
From: Rustam Kovhaev <rkovhaev@xxxxxxxxx>
Subject: ntfs: add check for mft record size in superblock
Number of bytes allocated for mft record should be equal to the mft record
size stored in ntfs superblock as reported by syzbot, userspace might
trigger out-of-bounds read by dereferencing ctx->attr in ntfs_attr_find()
Link: https://syzkaller.appspot.com/bug?extid=aed06913f36eff9b544e
Link: https://lkml.kernel.org/r/20200824022804.226242-1-rkovhaev@xxxxxxxxx
Reported-by: syzbot+aed06913f36eff9b544e@xxxxxxxxxxxxxxxxxxxxxxxxx
Tested-by: syzbot+aed06913f36eff9b544e@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Rustam Kovhaev <rkovhaev@xxxxxxxxx>
Acked-by: Anton Altaparmakov <anton@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
fs/ntfs/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ntfs/inode.c~ntfs-add-check-for-mft-record-size-in-superblock
+++ a/fs/ntfs/inode.c
@@ -1810,6 +1810,12 @@ int ntfs_read_inode_mount(struct inode *
brelse(bh);
}
+ if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) {
+ ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.",
+ le32_to_cpu(m->bytes_allocated), vol->mft_record_size);
+ goto err_out;
+ }
+
/* Apply the mst fixups. */
if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) {
/* FIXME: Try to use the $MFTMirr now. */
_
Patches currently in -mm which might be from rkovhaev@xxxxxxxxx are
