• ZhangPeng's avatar
    fs/ntfs3: Fix OOB read in indx_insert_into_buffer · b8c44949
    ZhangPeng authored
    Syzbot reported a OOB read bug:
    
    BUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0
    fs/ntfs3/index.c:1755
    Read of size 17168 at addr ffff8880255e06c0 by task syz-executor308/3630
    
    Call Trace:
     <TASK>
     memmove+0x25/0x60 mm/kasan/shadow.c:54
     indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755
     indx_insert_entry+0x446/0x6b0 fs/ntfs3/index.c:1863
     ntfs_create_inode+0x1d3f/0x35c0 fs/ntfs3/inode.c:1548
     ntfs_create+0x3e/0x60 fs/ntfs3/namei.c:100
     lookup_open fs/namei.c:3413 [inline]
    
    If the member struct INDEX_BUFFER *index of struct indx_node is
    incorrect, that is, the value of __le32 used is greater than the value
    of __le32 total in struct INDEX_HDR. Therefore, OOB read occurs when
    memmove is called in indx_insert_into_buffer().
    Fix this by adding a check in hdr_find_e().
    
    Fixes: 82cae269 ("fs/ntfs3: Add initialization of super block")
    Reported-by: syzbot+d882d57193079e379309@syzkaller.appspotmail.com
    Signed-off-by: default avatarZhangPeng <zhangpeng362@huawei.com>
    Signed-off-by: default avatarKonstantin Komarov <almaz.alexandrovich@paragon-software.com>
    b8c44949
index.c 55.6 KB