This is a note to let you know that I've just added the patch titled
fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super
to the 6.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fs-ntfs3-fix-shift-out-of-bounds-in-ntfs_fill_super.patch
and it can be found in the queue-6.5 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 91a4b1ee78cb100b19b70f077c247f211110348f Mon Sep 17 00:00:00 2001
From: Konstantin Komarov <almaz.alexandrovich@xxxxxxxxxxxxxxxxxxxx>
Date: Fri, 30 Jun 2023 16:25:25 +0400
Subject: fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super
From: Konstantin Komarov <almaz.alexandrovich@xxxxxxxxxxxxxxxxxxxx>
commit 91a4b1ee78cb100b19b70f077c247f211110348f upstream.
Reported-by: syzbot+478c1bf0e6bf4a8f3a04@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/ntfs3/ntfs_fs.h | 2 ++
fs/ntfs3/super.c | 26 ++++++++++++++++++++------
2 files changed, 22 insertions(+), 6 deletions(-)
--- a/fs/ntfs3/ntfs_fs.h
+++ b/fs/ntfs3/ntfs_fs.h
@@ -42,9 +42,11 @@ enum utf16_endian;
#define MINUS_ONE_T ((size_t)(-1))
/* Biggest MFT / smallest cluster */
#define MAXIMUM_BYTES_PER_MFT 4096
+#define MAXIMUM_SHIFT_BYTES_PER_MFT 12
#define NTFS_BLOCKS_PER_MFT_RECORD (MAXIMUM_BYTES_PER_MFT / 512)
#define MAXIMUM_BYTES_PER_INDEX 4096
+#define MAXIMUM_SHIFT_BYTES_PER_INDEX 12
#define NTFS_BLOCKS_PER_INODE (MAXIMUM_BYTES_PER_INDEX / 512)
/* NTFS specific error code when fixup failed. */
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -906,9 +906,17 @@ check_boot:
goto out;
}
- sbi->record_size = record_size =
- boot->record_size < 0 ? 1 << (-boot->record_size) :
- (u32)boot->record_size << cluster_bits;
+ if (boot->record_size >= 0) {
+ record_size = (u32)boot->record_size << cluster_bits;
+ } else if (-boot->record_size <= MAXIMUM_SHIFT_BYTES_PER_MFT) {
+ record_size = 1u << (-boot->record_size);
+ } else {
+ ntfs_err(sb, "%s: invalid record size %d.", hint,
+ boot->record_size);
+ goto out;
+ }
+
+ sbi->record_size = record_size;
sbi->record_bits = blksize_bits(record_size);
sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes
@@ -925,9 +933,15 @@ check_boot:
goto out;
}
- sbi->index_size = boot->index_size < 0 ?
- 1u << (-boot->index_size) :
- (u32)boot->index_size << cluster_bits;
+ if (boot->index_size >= 0) {
+ sbi->index_size = (u32)boot->index_size << cluster_bits;
+ } else if (-boot->index_size <= MAXIMUM_SHIFT_BYTES_PER_INDEX) {
+ sbi->index_size = 1u << (-boot->index_size);
+ } else {
+ ntfs_err(sb, "%s: invalid index size %d.", hint,
+ boot->index_size);
+ goto out;
+ }
/* Check index record size. */
if (sbi->index_size < SECTOR_SIZE || !is_power_of_2(sbi->index_size)) {
Patches currently in stable-queue which might be from almaz.alexandrovich@xxxxxxxxxxxxxxxxxxxx are
queue-6.5/fs-ntfs3-fix-oob-read-in-ntfs_init_from_boot.patch
queue-6.5/fs-ntfs3-fix-deadlock-in-mark_as_free_ex.patch
queue-6.5/fs-ntfs3-fix-panic-about-slab-out-of-bounds-caused-by-ntfs_list_ea.patch
queue-6.5/fs-ntfs3-fix-shift-out-of-bounds-in-ntfs_fill_super.patch
queue-6.5/fs-ntfs3-fix-possible-null-pointer-dereference-in-hdr_find_e.patch
