iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
87579e9b7d
linux/fs/ntfs
History
Desmond Cheong Zhi Xi d98e4d9541 ntfs: fix validity check for file name attribute 
When checking the file name attribute, we want to ensure that it fits
within the bounds of ATTR_RECORD.  To do this, we should check that (attr
record + file name offset + file name length) < (attr record + attr record
length).

However, the original check did not include the file name offset in the
calculation.  This means that corrupted on-disk metadata might not caught
by the incorrect file name check, and lead to an invalid memory access.

An example can be seen in the crash report of a memory corruption error
found by Syzbot:
https://syzkaller.appspot.com/bug?id=a1a1e379b225812688566745c3e2f7242bffc246

Adding the file name offset to the validity check fixes this error and
passes the Syzbot reproducer test.

Link: https://lkml.kernel.org/r/20210614050540.289494-1-desmondcheongzx@gmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reported-by: syzbot+213ac8bb98f7f4420840@syzkaller.appspotmail.com
Tested-by: syzbot+213ac8bb98f7f4420840@syzkaller.appspotmail.com
Acked-by: Anton Altaparmakov <anton@tuxera.com>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-06-29 10:53:45 -07:00
..
aops.c ntfs: replace attach_page_buffers with attach_page_private 2020-06-02 10:59:07 -07:00
aops.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
attrib.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
attrib.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
bitmap.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
bitmap.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
collate.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
collate.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
compress.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
debug.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
debug.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
dir.c ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type 2020-08-07 11:33:21 -07:00
dir.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
endian.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
file.c fs/ntfs: remove unused varibles 2020-12-15 12:13:37 -08:00
index.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
index.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
inode.c ntfs: fix validity check for file name attribute 2021-06-29 10:53:45 -07:00
inode.h fs: make helpers idmap mount aware 2021-01-24 14:27:20 +01:00
Kconfig docs: filesystems: fix renamed references 2020-04-20 15:45:22 -06:00
layout.h ntfs: layout.h: delete duplicated words 2021-02-24 13:38:26 -08:00
lcnalloc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
lcnalloc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
logfile.c fs/ntfs: remove unused varibles 2020-12-15 12:13:37 -08:00
logfile.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
malloc.h mm: remove the pgprot argument to __vmalloc 2020-06-02 10:59:11 -07:00
mft.c ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type 2020-08-07 11:33:21 -07:00
mft.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
mst.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
namei.c ntfs: remove (un)?likely() from IS_ERR() conditions 2019-09-26 10:10:44 -07:00
ntfs.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
quota.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
quota.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
runlist.c ntfs: remove (un)?likely() from IS_ERR() conditions 2019-09-26 10:10:44 -07:00
runlist.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
super.c [PATCH] reduce boilerplate in fsid handling 2020-09-18 16:45:50 -04:00
sysctl.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
sysctl.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
time.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
types.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
unistr.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
upcase.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 97 2019-05-24 17:37:53 +02:00
usnjrnl.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
usnjrnl.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00
volume.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 96 2019-05-24 17:37:53 +02:00