From: Roman Smirnov <r.smirnov@omp.ru>
To: <stable@vger.kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Cc: Roman Smirnov <r.smirnov@omp.ru>, <ntfs3@lists.linux.dev>,
<linux-kernel@vger.kernel.org>,
Sergey Shtylyov <s.shtylyov@omp.ru>,
<lvc-project@linuxtesting.org>,
<syzbot+478c1bf0e6bf4a8f3a04@syzkaller.appspotmail.com>
Subject: [PATCH 6.1 1/1] fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super
Date: Wed, 24 Apr 2024 13:11:14 +0300 [thread overview]
Message-ID: <20240424101114.192681-2-r.smirnov@omp.ru> (raw)
In-Reply-To: <20240424101114.192681-1-r.smirnov@omp.ru>
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
commit 91a4b1ee78cb100b19b70f077c247f211110348f upstream.
Reported-by: syzbot+478c1bf0e6bf4a8f3a04@syzkaller.appspotmail.com
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[Roman: added string hint, replaced cluster_bits with sbi->cluster_bits,
removed redundant checks near "Check MFT record size" and "Check index record
size".]
Signed-off-by: Roman Smirnov <r.smirnov@omp.ru>
---
fs/ntfs3/ntfs_fs.h | 2 ++
fs/ntfs3/super.c | 50 +++++++++++++++++++++++++++++-----------------
2 files changed, 34 insertions(+), 18 deletions(-)
diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
index 0f9bec29f2b70..50ae3a6cb3559 100644
--- a/fs/ntfs3/ntfs_fs.h
+++ b/fs/ntfs3/ntfs_fs.h
@@ -42,9 +42,11 @@ enum utf16_endian;
#define MINUS_ONE_T ((size_t)(-1))
/* Biggest MFT / smallest cluster */
#define MAXIMUM_BYTES_PER_MFT 4096
+#define MAXIMUM_SHIFT_BYTES_PER_MFT 12
#define NTFS_BLOCKS_PER_MFT_RECORD (MAXIMUM_BYTES_PER_MFT / 512)
#define MAXIMUM_BYTES_PER_INDEX 4096
+#define MAXIMUM_SHIFT_BYTES_PER_INDEX 12
#define NTFS_BLOCKS_PER_INODE (MAXIMUM_BYTES_PER_INDEX / 512)
/* NTFS specific error code when fixup failed. */
diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index 6066eea3f61cb..863119b6a2a8d 100644
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -690,6 +690,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
struct buffer_head *bh;
struct MFT_REC *rec;
u16 fn, ao;
+ const char *hint = "Primary boot";
sbi->volume.blocks = dev_size >> PAGE_SHIFT;
@@ -731,17 +732,24 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
if (mlcn2 * sct_per_clst >= sectors)
goto out;
- /* Check MFT record size. */
- if ((boot->record_size < 0 &&
- SECTOR_SIZE > (2U << (-boot->record_size))) ||
- (boot->record_size >= 0 && !is_power_of_2(boot->record_size))) {
+ if (boot->record_size >= 0) {
+ record_size = (u32)boot->record_size << sbi->cluster_bits;
+ } else if (-boot->record_size <= MAXIMUM_SHIFT_BYTES_PER_MFT) {
+ record_size = 1u << (-boot->record_size);
+ } else {
+ ntfs_err(sb, "%s: invalid record size %d.", hint,
+ boot->record_size);
goto out;
}
- /* Check index record size. */
- if ((boot->index_size < 0 &&
- SECTOR_SIZE > (2U << (-boot->index_size))) ||
- (boot->index_size >= 0 && !is_power_of_2(boot->index_size))) {
+ sbi->record_size = record_size;
+ sbi->record_bits = blksize_bits(record_size);
+ sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes
+
+ /* Check MFT record size. */
+ if (record_size < SECTOR_SIZE || !is_power_of_2(record_size)) {
+ ntfs_err(sb, "%s: invalid bytes per MFT record %u (%d).", hint,
+ record_size, boot->record_size);
goto out;
}
@@ -784,26 +792,32 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
sbi->cluster_mask = sbi->cluster_size - 1;
sbi->cluster_mask_inv = ~(u64)sbi->cluster_mask;
- sbi->record_size = record_size = boot->record_size < 0
- ? 1 << (-boot->record_size)
- : (u32)boot->record_size
- << sbi->cluster_bits;
if (record_size > MAXIMUM_BYTES_PER_MFT || record_size < SECTOR_SIZE)
goto out;
- sbi->record_bits = blksize_bits(record_size);
- sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes
+ if (boot->index_size >= 0) {
+ sbi->index_size = (u32)boot->index_size << sbi->cluster_bits;
+ } else if (-boot->index_size <= MAXIMUM_SHIFT_BYTES_PER_INDEX) {
+ sbi->index_size = 1u << (-boot->index_size);
+ } else {
+ ntfs_err(sb, "%s: invalid index size %d.", hint,
+ boot->index_size);
+ goto out;
+ }
+
+ /* Check index record size. */
+ if (sbi->index_size < SECTOR_SIZE || !is_power_of_2(sbi->index_size)) {
+ ntfs_err(sb, "%s: invalid bytes per index %u(%d).", hint,
+ sbi->index_size, boot->index_size);
+ goto out;
+ }
sbi->max_bytes_per_attr =
record_size - ALIGN(MFTRECORD_FIXUP_OFFSET_1, 8) -
ALIGN(((record_size >> SECTOR_SHIFT) * sizeof(short)), 8) -
ALIGN(sizeof(enum ATTR_TYPE), 8);
- sbi->index_size = boot->index_size < 0
- ? 1u << (-boot->index_size)
- : (u32)boot->index_size << sbi->cluster_bits;
-
sbi->volume.ser_num = le64_to_cpu(boot->serial_num);
/* Warning if RAW volume. */
--
2.34.1
prev parent reply other threads:[~2024-04-24 10:11 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-24 10:11 [PATCH 6.1 0/1] fs: ntfs3: fix UBSAN: shift-out-of-bounds in ntfs_fill_super() Roman Smirnov
2024-04-24 10:11 ` Roman Smirnov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240424101114.192681-2-r.smirnov@omp.ru \
--to=r.smirnov@omp.ru \
--cc=almaz.alexandrovich@paragon-software.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lvc-project@linuxtesting.org \
--cc=ntfs3@lists.linux.dev \
--cc=s.shtylyov@omp.ru \
--cc=stable@vger.kernel.org \
--cc=syzbot+478c1bf0e6bf4a8f3a04@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).