From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Rustam Kovhaev <rkovhaev@gmail.com>,
syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com,
Anton Altaparmakov <anton@tuxera.com>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 5.10 08/23] ntfs: check for valid standard information attribute
Date: Thu, 25 Feb 2021 10:53:39 +0100 [thread overview]
Message-ID: <20210225092516.936771047@linuxfoundation.org> (raw)
In-Reply-To: <20210225092516.531932232@linuxfoundation.org>
From: Rustam Kovhaev <rkovhaev@gmail.com>
commit 4dfe6bd94959222e18d512bdf15f6bf9edb9c27c upstream.
Mounting a corrupted filesystem with NTFS resulted in a kernel crash.
We should check for valid STANDARD_INFORMATION attribute offset and length
before trying to access it
Link: https://lkml.kernel.org/r/20210217155930.1506815-1-rkovhaev@gmail.com
Link: https://syzkaller.appspot.com/bug?extid=c584225dabdea2f71969
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Reported-by: syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com
Tested-by: syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com
Acked-by: Anton Altaparmakov <anton@tuxera.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs/inode.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -629,6 +629,12 @@ static int ntfs_read_locked_inode(struct
}
a = ctx->attr;
/* Get the standard information attribute value. */
+ if ((u8 *)a + le16_to_cpu(a->data.resident.value_offset)
+ + le32_to_cpu(a->data.resident.value_length) >
+ (u8 *)ctx->mrec + vol->mft_record_size) {
+ ntfs_error(vi->i_sb, "Corrupt standard information attribute in inode.");
+ goto unm_err_out;
+ }
si = (STANDARD_INFORMATION*)((u8*)a +
le16_to_cpu(a->data.resident.value_offset));
next prev parent reply other threads:[~2021-02-25 10:13 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-25 9:53 [PATCH 5.10 00/23] 5.10.19-rc1 review Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 01/23] bpf: Fix truncation handling for mod32 dst reg wrt zero Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 02/23] HID: make arrays usage and value to be the same Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 03/23] RDMA: Lift ibdev_to_node from rds to common code Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 04/23] nvme-rdma: Use ibdev_to_node instead of dereferencing ->dma_device Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 05/23] USB: quirks: sort quirk entries Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 06/23] usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 07/23] ceph: downgrade warning from mdsmap decode to debug Greg Kroah-Hartman
2021-02-25 9:53 ` Greg Kroah-Hartman [this message]
2021-02-25 9:53 ` [PATCH 5.10 09/23] Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 10/23] arm64: tegra: Add power-domain for Tegra210 HDA Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 11/23] hwmon: (dell-smm) Add XPS 15 L502X to fan control blacklist Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 12/23] KVM: x86: Zap the oldest MMU pages, not the newest Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 13/23] mm: unexport follow_pte_pmd Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 14/23] mm: simplify follow_pte{,pmd} Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 15/23] KVM: do not assume PTE is writable after follow_pfn Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 16/23] mm: provide a saner PTE walking API for modules Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 17/23] KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped() Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 18/23] drm/xlnx: fix kmemleak by sending vblank_event in atomic_disable Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 19/23] NET: usb: qmi_wwan: Adding support for Cinterion MV31 Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 20/23] cxgb4: Add new T6 PCI device id 0x6092 Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 21/23] cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 22/23] kbuild: fix CONFIG_TRIM_UNUSED_KSYMS build for ppc64 Greg Kroah-Hartman
2021-02-25 9:53 ` [PATCH 5.10 23/23] scripts/recordmcount.pl: support big endian for ARCH sh Greg Kroah-Hartman
2021-02-25 19:52 ` [PATCH 5.10 00/23] 5.10.19-rc1 review Guenter Roeck
2021-02-25 19:54 ` Pavel Machek
2021-02-25 21:35 ` Florian Fainelli
2021-02-26 2:24 ` Shuah Khan
2021-02-26 3:41 ` Ross Schmidt
2021-02-26 6:44 ` Hanjun Guo
2021-02-27 1:47 ` Hanjun Guo
2021-02-26 6:57 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210225092516.936771047@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=anton@tuxera.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rkovhaev@gmail.com \
--cc=stable@vger.kernel.org \
--cc=syzbot+c584225dabdea2f71969@syzkaller.appspotmail.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox