Unverified Commit 91a4b1ee authored by Konstantin Komarov's avatar Konstantin Komarov
Browse files

fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super 



Reported-by: default avatar <syzbot+478c1bf0e6bf4a8f3a04@syzkaller.appspotmail.com>
Signed-off-by: default avatarKonstantin Komarov <almaz.alexandrovich@paragon-software.com>
parent bfbe5b31

fs/ntfs3/ntfs_fs.h

+2 −0
Original line number Diff line number Diff line
@@ -42,9 +42,11 @@ enum utf16_endian; 
#define MINUS_ONE_T			((size_t)(-1))

/* Biggest MFT / smallest cluster */

#define MAXIMUM_BYTES_PER_MFT		4096

#define MAXIMUM_SHIFT_BYTES_PER_MFT	12

#define NTFS_BLOCKS_PER_MFT_RECORD	(MAXIMUM_BYTES_PER_MFT / 512)



#define MAXIMUM_BYTES_PER_INDEX		4096

#define MAXIMUM_SHIFT_BYTES_PER_INDEX	12

#define NTFS_BLOCKS_PER_INODE		(MAXIMUM_BYTES_PER_INDEX / 512)



/* NTFS specific error code when fixup failed. */

fs/ntfs3/super.c

+20 −6
Original line number Diff line number Diff line
@@ -899,9 +899,17 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, 
		goto out;

	}



	sbi->record_size = record_size =

		boot->record_size < 0 ? 1 << (-boot->record_size) :

					(u32)boot->record_size << cluster_bits;

	if (boot->record_size >= 0) {

		record_size = (u32)boot->record_size << cluster_bits;

	} else if (-boot->record_size <= MAXIMUM_SHIFT_BYTES_PER_MFT) {

		record_size = 1u << (-boot->record_size);

	} else {

		ntfs_err(sb, "%s: invalid record size %d.", hint,

			 boot->record_size);

		goto out;

	}



	sbi->record_size = record_size;

	sbi->record_bits = blksize_bits(record_size);

	sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes
@@ -918,9 +926,15 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, 
		goto out;

	}



	sbi->index_size = boot->index_size < 0 ?

				  1u << (-boot->index_size) :

				  (u32)boot->index_size << cluster_bits;

	if (boot->index_size >= 0) {

		sbi->index_size = (u32)boot->index_size << cluster_bits;

	} else if (-boot->index_size <= MAXIMUM_SHIFT_BYTES_PER_INDEX) {

		sbi->index_size = 1u << (-boot->index_size);

	} else {

		ntfs_err(sb, "%s: invalid index size %d.", hint,

			 boot->index_size);

		goto out;

	}



	/* Check index record size. */

	if (sbi->index_size < SECTOR_SIZE || !is_power_of_2(sbi->index_size)) {