mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-04 16:15:11 +00:00
fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super
Reported-by: syzbot+478c1bf0e6bf4a8f3a04@syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
This commit is contained in:
parent
bfbe5b31ca
commit
91a4b1ee78
2 changed files with 22 additions and 6 deletions
|
@ -42,9 +42,11 @@ enum utf16_endian;
|
||||||
#define MINUS_ONE_T ((size_t)(-1))
|
#define MINUS_ONE_T ((size_t)(-1))
|
||||||
/* Biggest MFT / smallest cluster */
|
/* Biggest MFT / smallest cluster */
|
||||||
#define MAXIMUM_BYTES_PER_MFT 4096
|
#define MAXIMUM_BYTES_PER_MFT 4096
|
||||||
|
#define MAXIMUM_SHIFT_BYTES_PER_MFT 12
|
||||||
#define NTFS_BLOCKS_PER_MFT_RECORD (MAXIMUM_BYTES_PER_MFT / 512)
|
#define NTFS_BLOCKS_PER_MFT_RECORD (MAXIMUM_BYTES_PER_MFT / 512)
|
||||||
|
|
||||||
#define MAXIMUM_BYTES_PER_INDEX 4096
|
#define MAXIMUM_BYTES_PER_INDEX 4096
|
||||||
|
#define MAXIMUM_SHIFT_BYTES_PER_INDEX 12
|
||||||
#define NTFS_BLOCKS_PER_INODE (MAXIMUM_BYTES_PER_INDEX / 512)
|
#define NTFS_BLOCKS_PER_INODE (MAXIMUM_BYTES_PER_INDEX / 512)
|
||||||
|
|
||||||
/* NTFS specific error code when fixup failed. */
|
/* NTFS specific error code when fixup failed. */
|
||||||
|
|
|
@ -899,9 +899,17 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
|
||||||
sbi->record_size = record_size =
|
if (boot->record_size >= 0) {
|
||||||
boot->record_size < 0 ? 1 << (-boot->record_size) :
|
record_size = (u32)boot->record_size << cluster_bits;
|
||||||
(u32)boot->record_size << cluster_bits;
|
} else if (-boot->record_size <= MAXIMUM_SHIFT_BYTES_PER_MFT) {
|
||||||
|
record_size = 1u << (-boot->record_size);
|
||||||
|
} else {
|
||||||
|
ntfs_err(sb, "%s: invalid record size %d.", hint,
|
||||||
|
boot->record_size);
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
|
sbi->record_size = record_size;
|
||||||
sbi->record_bits = blksize_bits(record_size);
|
sbi->record_bits = blksize_bits(record_size);
|
||||||
sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes
|
sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes
|
||||||
|
|
||||||
|
@ -918,9 +926,15 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
|
||||||
sbi->index_size = boot->index_size < 0 ?
|
if (boot->index_size >= 0) {
|
||||||
1u << (-boot->index_size) :
|
sbi->index_size = (u32)boot->index_size << cluster_bits;
|
||||||
(u32)boot->index_size << cluster_bits;
|
} else if (-boot->index_size <= MAXIMUM_SHIFT_BYTES_PER_INDEX) {
|
||||||
|
sbi->index_size = 1u << (-boot->index_size);
|
||||||
|
} else {
|
||||||
|
ntfs_err(sb, "%s: invalid index size %d.", hint,
|
||||||
|
boot->index_size);
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
/* Check index record size. */
|
/* Check index record size. */
|
||||||
if (sbi->index_size < SECTOR_SIZE || !is_power_of_2(sbi->index_size)) {
|
if (sbi->index_size < SECTOR_SIZE || !is_power_of_2(sbi->index_size)) {
|
||||||
|
|
Loading…
Reference in a new issue