mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-16 07:35:14 +00:00
fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs
[ Upstream commit557d19675a
] Syzbot reports an out of bound access in ntfs_trim_fs. The cause of this is using a loop termination condition that compares window index (iw) with wnd->nbits instead of wnd->nwnd, due to which the index used for wnd->free_bits exceeds the size of the array allocated. Fix the loop condition. Fixes:3f3b442b5a
("fs/ntfs3: Add bitmap") Link: https://syzkaller.appspot.com/bug?extid=b892240eac461e488d51 Reported-by: syzbot+b892240eac461e488d51@syzkaller.appspotmail.com Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
1ba0968b33
commit
ab53749c32
1 changed files with 1 additions and 1 deletions
|
@ -1432,7 +1432,7 @@ int ntfs_trim_fs(struct ntfs_sb_info *sbi, struct fstrim_range *range)
|
|||
|
||||
down_read_nested(&wnd->rw_lock, BITMAP_MUTEX_CLUSTERS);
|
||||
|
||||
for (; iw < wnd->nbits; iw++, wbit = 0) {
|
||||
for (; iw < wnd->nwnd; iw++, wbit = 0) {
|
||||
CLST lcn_wnd = iw * wbits;
|
||||
struct buffer_head *bh;
|
||||
|
||||
|
|
Loading…
Reference in a new issue