| Message ID | 20220429200100.22659-1-rdunlap@infradead.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] fs/ntfs3: validate BOOT sectors_per_clusters | expand |
On Fri, Apr 29, 2022 at 01:01:00PM -0700, Randy Dunlap wrote: > When the NTFS BOOT sectors_per_clusters field is > 0x80, > it represents a shift value. Make sure that the shift value is > not too large (> 31) before using it. Return 0xffffffff if it is. > > This prevents negative shift values and shift values that are > larger than the field size. > > Prevents this UBSAN error: > > UBSAN: shift-out-of-bounds in ../fs/ntfs3/super.c:673:16 > shift exponent -192 is negative > > Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") > Signed-off-by: Randy Dunlap <rdunlap@infradead.org> > Reported-by: syzbot+1631f09646bc214d2e76@syzkaller.appspotmail.com Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
2022-04-30 5:01 GMT+09:00, Randy Dunlap <rdunlap@infradead.org>: > When the NTFS BOOT sectors_per_clusters field is > 0x80, > it represents a shift value. Make sure that the shift value is > not too large (> 31) before using it. Return 0xffffffff if it is. > > This prevents negative shift values and shift values that are > larger than the field size. > > Prevents this UBSAN error: > > UBSAN: shift-out-of-bounds in ../fs/ntfs3/super.c:673:16 > shift exponent -192 is negative > > Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") > Signed-off-by: Randy Dunlap <rdunlap@infradead.org> > Reported-by: syzbot+1631f09646bc214d2e76@syzkaller.appspotmail.com > Cc: Konstantin Komarov <almaz.alexandrovich@paragon-software.com> > Cc: ntfs3@lists.linux.dev > Cc: Alexander Viro <viro@zeniv.linux.org.uk> > Cc: Andrew Morton <akpm@linux-foundation.org> > Cc: Kari Argillander <kari.argillander@stargateuniverse.net> > Cc: Namjae Jeon <linkinjeon@kernel.org> > Cc: Matthew Wilcox <willy@infradead.org> > --- > v2: use Willy's suggestions > > fs/ntfs3/super.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > --- linux-next-20220428.orig/fs/ntfs3/super.c > +++ linux-next-20220428/fs/ntfs3/super.c > @@ -668,9 +668,11 @@ static u32 format_size_gb(const u64 byte > > static u32 true_sectors_per_clst(const struct NTFS_BOOT *boot) > { > - return boot->sectors_per_clusters <= 0x80 > - ? boot->sectors_per_clusters > - : (1u << (0 - boot->sectors_per_clusters)); > + if (boot->sectors_per_clusters <= 0x80) > + return boot->sectors_per_clusters; > + if (boot->sectors_per_clusters > 0xe0) /* limit to 31-bit shift */ ntfs maximum cluster size is 2MB. I think that we can change it to boot->sectors_per_clusters >= 0xf4. > + return 1U << (0 - boot->sectors_per_clusters); > + return 0xffffffff; It would be better to change it to return an error(-EINVAL) instead of 0xffffffff. and if sct_per_clst < 0, goto out immediately.. > } > > /* > >
--- linux-next-20220428.orig/fs/ntfs3/super.c +++ linux-next-20220428/fs/ntfs3/super.c @@ -668,9 +668,11 @@ static u32 format_size_gb(const u64 byte static u32 true_sectors_per_clst(const struct NTFS_BOOT *boot) { - return boot->sectors_per_clusters <= 0x80 - ? boot->sectors_per_clusters - : (1u << (0 - boot->sectors_per_clusters)); + if (boot->sectors_per_clusters <= 0x80) + return boot->sectors_per_clusters; + if (boot->sectors_per_clusters > 0xe0) /* limit to 31-bit shift */ + return 1U << (0 - boot->sectors_per_clusters); + return 0xffffffff; } /*
When the NTFS BOOT sectors_per_clusters field is > 0x80, it represents a shift value. Make sure that the shift value is not too large (> 31) before using it. Return 0xffffffff if it is. This prevents negative shift values and shift values that are larger than the field size. Prevents this UBSAN error: UBSAN: shift-out-of-bounds in ../fs/ntfs3/super.c:673:16 shift exponent -192 is negative Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reported-by: syzbot+1631f09646bc214d2e76@syzkaller.appspotmail.com Cc: Konstantin Komarov <almaz.alexandrovich@paragon-software.com> Cc: ntfs3@lists.linux.dev Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Kari Argillander <kari.argillander@stargateuniverse.net> Cc: Namjae Jeon <linkinjeon@kernel.org> Cc: Matthew Wilcox <willy@infradead.org> --- v2: use Willy's suggestions fs/ntfs3/super.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)