From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Rustam Kovhaev <rkovhaev@gmail.com>,
syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com,
Anton Altaparmakov <anton@tuxera.com>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 5.11 05/12] ntfs: check for valid standard information attribute
Date: Thu, 25 Feb 2021 10:53:39 +0100 [thread overview]
Message-ID: <20210225092515.261565343@linuxfoundation.org> (raw)
In-Reply-To: <20210225092515.015261674@linuxfoundation.org>
From: Rustam Kovhaev <rkovhaev@gmail.com>
commit 4dfe6bd94959222e18d512bdf15f6bf9edb9c27c upstream.
Mounting a corrupted filesystem with NTFS resulted in a kernel crash.
We should check for valid STANDARD_INFORMATION attribute offset and length
before trying to access it
Link: https://lkml.kernel.org/r/20210217155930.1506815-1-rkovhaev@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=c584225dabdea2f71969
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Reported-by: syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com
Tested-by: syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com
Acked-by: Anton Altaparmakov <anton@tuxera.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -629,6 +629,12 @@ static int ntfs_read_locked_inode(struct
}
a = ctx->attr;
/* Get the standard information attribute value. */
+ if ((u8 *)a + le16_to_cpu(a->data.resident.value_offset)
+ + le32_to_cpu(a->data.resident.value_length) >
+ (u8 *)ctx->mrec + vol->mft_record_size) {
+ ntfs_error(vi->i_sb, "Corrupt standard information attribute in inode.");
+ goto unm_err_out;
+ }
si = (STANDARD_INFORMATION*)((u8*)a +
le16_to_cpu(a->data.resident.value_offset));
next prev parent reply other threads:[~2021-02-25 9:59 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-25 9:53 [PATCH 5.11 00/12] 5.11.2-rc1 review Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 01/12] bpf: Fix truncation handling for mod32 dst reg wrt zero Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 02/12] HID: make arrays usage and value to be the same Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 03/12] USB: quirks: sort quirk entries Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 04/12] usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable Greg Kroah-Hartman
2021-02-25 9:53 ` Greg Kroah-Hartman [this message]
2021-02-25 9:53 ` [PATCH 5.11 06/12] Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 07/12] arm64: tegra: Add power-domain for Tegra210 HDA Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 08/12] hwmon: (dell-smm) Add XPS 15 L502X to fan control blacklist Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 09/12] KVM: x86: Zap the oldest MMU pages, not the newest Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 10/12] KVM: do not assume PTE is writable after follow_pfn Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 11/12] mm: provide a saner PTE walking API for modules Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 12/12] KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped() Greg Kroah-Hartman
2021-02-25 11:47 ` [PATCH 5.11 00/12] 5.11.2-rc1 review Jon Hunter
2021-02-25 19:52 ` Guenter Roeck
2021-02-26 2:24 ` Shuah Khan
2021-02-26 3:45 ` Ross Schmidt
2021-02-26 8:00 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210225092515.261565343@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=anton@tuxera.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rkovhaev@gmail.com \
--cc=stable@vger.kernel.org \
--cc=syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.