From nobody Mon Feb 9 04:44:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB506C0015E for ; Mon, 3 Jul 2023 07:28:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230206AbjGCH2f (ORCPT ); Mon, 3 Jul 2023 03:28:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34120 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230471AbjGCH2c (ORCPT ); Mon, 3 Jul 2023 03:28:32 -0400 Received: from relayaws-01.paragon-software.com (relayaws-01.paragon-software.com [35.157.23.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E2A74E55; Mon, 3 Jul 2023 00:28:28 -0700 (PDT) Received: from relayfre-01.paragon-software.com (unknown [172.30.72.12]) by relayaws-01.paragon-software.com (Postfix) with ESMTPS id 94B1C1D21; Mon, 3 Jul 2023 07:23:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paragon-software.com; s=mail; t=1688368995; bh=zSbz2rcKBXxPlxirBwRjMtqYwWRIZxW3itsjx+mpDUw=; h=Date:Subject:From:To:CC:References:In-Reply-To; b=DYoyooiNxquY396tRP4PveJSv97Iv0Ubc6k8OL0qQxFCA6XV8qkchtYOOoqDY9Ra+ t7yKwtRq3jIZDDqVANBULtAwLYwL/8uGar/18pHjMuBWJwDrWjiil/HB6HfJPIKS5G FLI/MYkMXFukxZXJvtk/m+4OJcOXuR370YsZz3Ag= Received: from dlg2.mail.paragon-software.com (vdlg-exch-02.paragon-software.com [172.30.1.105]) by relayfre-01.paragon-software.com (Postfix) with ESMTPS id 0DE091D1E; Mon, 3 Jul 2023 07:28:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paragon-software.com; s=mail; t=1688369307; bh=zSbz2rcKBXxPlxirBwRjMtqYwWRIZxW3itsjx+mpDUw=; h=Date:Subject:From:To:CC:References:In-Reply-To; b=Lv+C1XgnNu8FamEESwPA7jrLynFkxB2x/2GVVnBNxkQPd5KO6vOyXEnbwYKGvxWMy QEdp3btymMdQO3l0HSsf1HdeQ+5KGzxNAQpPfAtjTFD79NrSQK+I+Y//QUVuoFJ8Hw v5bT3YcVraRNSndWCb5HxWWSgnKku9tLZ6TUgG3o= Received: from [192.168.211.138] (192.168.211.138) by vdlg-exch-02.paragon-software.com (172.30.1.105) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.7; Mon, 3 Jul 2023 10:28:26 +0300 Message-ID: Date: Mon, 3 Jul 2023 11:28:25 +0400 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.12.0 Subject: [PATCH 8/8] fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super Content-Language: en-US From: Konstantin Komarov To: CC: Linux Kernel Mailing List , References: In-Reply-To: Content-Type: text/plain; charset="utf-8"; format="flowed" Content-Transfer-Encoding: quoted-printable X-Originating-IP: [192.168.211.138] X-ClientProxiedBy: vdlg-exch-02.paragon-software.com (172.30.1.105) To vdlg-exch-02.paragon-software.com (172.30.1.105) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Reported-by: syzbot+478c1bf0e6bf4a8f3a04@syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov --- =C2=A0fs/ntfs3/ntfs_fs.h |=C2=A0 2 ++ =C2=A0fs/ntfs3/super.c=C2=A0=C2=A0 | 26 ++++++++++++++++++++------ =C2=A02 files changed, 22 insertions(+), 6 deletions(-) diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h index 629403ede6e5..788567d71d93 100644 --- a/fs/ntfs3/ntfs_fs.h +++ b/fs/ntfs3/ntfs_fs.h @@ -42,9 +42,11 @@ enum utf16_endian; =C2=A0#define MINUS_ONE_T=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2= =A0 =C2=A0((size_t)(-1)) =C2=A0/* Biggest MFT / smallest cluster */ =C2=A0#define MAXIMUM_BYTES_PER_MFT=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A04= 096 +#define MAXIMUM_SHIFT_BYTES_PER_MFT=C2=A0=C2=A0 =C2=A012 =C2=A0#define NTFS_BLOCKS_PER_MFT_RECORD=C2=A0=C2=A0 =C2=A0(MAXIMUM_BYTES_= PER_MFT / 512) =C2=A0#define MAXIMUM_BYTES_PER_INDEX=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2= =A04096 +#define MAXIMUM_SHIFT_BYTES_PER_INDEX=C2=A0=C2=A0 =C2=A012 =C2=A0#define NTFS_BLOCKS_PER_INODE=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0(= MAXIMUM_BYTES_PER_INDEX / 512) =C2=A0/* NTFS specific error code when fixup failed. */ diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index 0034952b9ccd..34ebfaa8fbab 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -905,9 +905,17 @@ static int ntfs_init_from_boot(struct super_block=20 *sb, u32 sector_size, =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0goto out; =C2=A0=C2=A0=C2=A0 =C2=A0} -=C2=A0=C2=A0 =C2=A0sbi->record_size =3D record_size =3D -=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0boot->record_size < 0 ? 1 << (-boot-= >record_size) : -=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2= =A0=C2=A0=C2=A0 =C2=A0(u32)boot->record_size << cluster_bits; +=C2=A0=C2=A0 =C2=A0if (boot->record_size >=3D 0) { +=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0record_size =3D (u32)boot->record_si= ze << cluster_bits; +=C2=A0=C2=A0 =C2=A0} else if (-boot->record_size <=3D MAXIMUM_SHIFT_BYTES_= PER_MFT) { +=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0record_size =3D 1u << (-boot->record= _size); +=C2=A0=C2=A0 =C2=A0} else { +=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0ntfs_err(sb, "%s: invalid record siz= e %d.", hint, +=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0 boot->record_siz= e); +=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0goto out; +=C2=A0=C2=A0 =C2=A0} + +=C2=A0=C2=A0 =C2=A0sbi->record_size =3D record_size; =C2=A0=C2=A0=C2=A0 =C2=A0sbi->record_bits =3D blksize_bits(record_size); =C2=A0=C2=A0=C2=A0 =C2=A0sbi->attr_size_tr =3D (5 * record_size >> 4); // = ~320 bytes @@ -924,9 +932,15 @@ static int ntfs_init_from_boot(struct super_block=20 *sb, u32 sector_size, =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0goto out; =C2=A0=C2=A0=C2=A0 =C2=A0} -=C2=A0=C2=A0 =C2=A0sbi->index_size =3D boot->index_size < 0 ? -=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2= =A0=C2=A0 1u << (-boot->index_size) : -=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2= =A0=C2=A0 (u32)boot->index_size << cluster_bits; +=C2=A0=C2=A0 =C2=A0if (boot->index_size >=3D 0) { +=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0sbi->index_size =3D (u32)boot->index= _size << cluster_bits; +=C2=A0=C2=A0 =C2=A0} else if (-boot->index_size <=3D MAXIMUM_SHIFT_BYTES_P= ER_INDEX) { +=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0sbi->index_size =3D 1u << (-boot->in= dex_size); +=C2=A0=C2=A0 =C2=A0} else { +=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0ntfs_err(sb, "%s: invalid index size= %d.", hint, +=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0 boot->index_size= ); +=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0goto out; +=C2=A0=C2=A0 =C2=A0} =C2=A0=C2=A0=C2=A0 =C2=A0/* Check index record size. */ =C2=A0=C2=A0=C2=A0 =C2=A0if (sbi->index_size < SECTOR_SIZE ||=20 !is_power_of_2(sbi->index_size)) { --=20 2.34.1