From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Rustam Kovhaev <rkovhaev@gmail.com>,
syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com,
Anton Altaparmakov <anton@tuxera.com>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 5.11 05/12] ntfs: check for valid standard information attribute
Date: Thu, 25 Feb 2021 10:53:39 +0100 [thread overview]
Message-ID: <20210225092515.261565343@linuxfoundation.org> (raw)
In-Reply-To: <20210225092515.015261674@linuxfoundation.org>
From: Rustam Kovhaev <rkovhaev@gmail.com>
commit 4dfe6bd94959222e18d512bdf15f6bf9edb9c27c upstream.
Mounting a corrupted filesystem with NTFS resulted in a kernel crash.
We should check for valid STANDARD_INFORMATION attribute offset and length
before trying to access it
Link: https://lkml.kernel.org/r/20210217155930.1506815-1-rkovhaev@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=c584225dabdea2f71969
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Reported-by: syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com
Tested-by: syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com
Acked-by: Anton Altaparmakov <anton@tuxera.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -629,6 +629,12 @@ static int ntfs_read_locked_inode(struct
}
a = ctx->attr;
/* Get the standard information attribute value. */
+ if ((u8 *)a + le16_to_cpu(a->data.resident.value_offset)
+ + le32_to_cpu(a->data.resident.value_length) >
+ (u8 *)ctx->mrec + vol->mft_record_size) {
+ ntfs_error(vi->i_sb, "Corrupt standard information attribute in inode.");
+ goto unm_err_out;
+ }
si = (STANDARD_INFORMATION*)((u8*)a +
le16_to_cpu(a->data.resident.value_offset));
next prev parent reply other threads:[~2021-02-25 9:59 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-25 9:53 [PATCH 5.11 00/12] 5.11.2-rc1 review Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 01/12] bpf: Fix truncation handling for mod32 dst reg wrt zero Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 02/12] HID: make arrays usage and value to be the same Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 03/12] USB: quirks: sort quirk entries Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 04/12] usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable Greg Kroah-Hartman
2021-02-25 9:53 ` Greg Kroah-Hartman [this message]
2021-02-25 9:53 ` [PATCH 5.11 06/12] Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 07/12] arm64: tegra: Add power-domain for Tegra210 HDA Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 08/12] hwmon: (dell-smm) Add XPS 15 L502X to fan control blacklist Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 09/12] KVM: x86: Zap the oldest MMU pages, not the newest Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 10/12] KVM: do not assume PTE is writable after follow_pfn Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 11/12] mm: provide a saner PTE walking API for modules Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.11 12/12] KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped() Greg Kroah-Hartman
2021-02-25 19:52 ` [PATCH 5.11 00/12] 5.11.2-rc1 review Guenter Roeck
2021-02-26 2:24 ` Shuah Khan
2021-02-26 3:45 ` Ross Schmidt
2021-02-26 8:00 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210225092515.261565343@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=anton@tuxera.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rkovhaev@gmail.com \
--cc=stable@vger.kernel.org \
--cc=syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox