[lvc-project] [PATCH 6.1 1/1] fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super

[Fedor Pchelkin]

Добрый вечер, Роман! Спасибо за подготовленный бэкпорт-патч!

Маленький комментарий ниже.

On Wed, 24. Apr 13:11, Roman Smirnov wrote:
> From: Konstantin Komarov <almaz.alexandrovich at paragon-software.com>
> 
> commit 91a4b1ee78cb100b19b70f077c247f211110348f upstream. 
> 
> Reported-by: syzbot+478c1bf0e6bf4a8f3a04 at syzkaller.appspotmail.com
> Signed-off-by: Konstantin Komarov <almaz.alexandrovich at paragon-software.com>
> [Roman: added string hint, replaced cluster_bits with sbi->cluster_bits, 
> removed redundant checks near "Check MFT record size" and "Check index record 
> size".]
> Signed-off-by: Roman Smirnov <r.smirnov at omp.ru>
> ---

hint был добавлен коммитом 6a4cd3ea7d77 ("fs/ntfs3: Alternative boot if
primary boot is corrupted") [1] и имеет ценность только после им внесённого
варианта альтернативной загрузки. В более ранние стабильные ветки, где нет
указанного коммита, не думаю, что hint стоит внедрять.

[1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6a4cd3ea7d77

>  fs/ntfs3/ntfs_fs.h |  2 ++
>  fs/ntfs3/super.c   | 50 +++++++++++++++++++++++++++++-----------------
>  2 files changed, 34 insertions(+), 18 deletions(-)
> 
> diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
> index 0f9bec29f2b70..50ae3a6cb3559 100644
> --- a/fs/ntfs3/ntfs_fs.h
> +++ b/fs/ntfs3/ntfs_fs.h
> @@ -42,9 +42,11 @@ enum utf16_endian;
>  #define MINUS_ONE_T			((size_t)(-1))
>  /* Biggest MFT / smallest cluster */
>  #define MAXIMUM_BYTES_PER_MFT		4096
> +#define MAXIMUM_SHIFT_BYTES_PER_MFT	12
>  #define NTFS_BLOCKS_PER_MFT_RECORD	(MAXIMUM_BYTES_PER_MFT / 512)
>  
>  #define MAXIMUM_BYTES_PER_INDEX		4096
> +#define MAXIMUM_SHIFT_BYTES_PER_INDEX	12
>  #define NTFS_BLOCKS_PER_INODE		(MAXIMUM_BYTES_PER_INDEX / 512)
>  
>  /* NTFS specific error code when fixup failed. */
> diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
> index 6066eea3f61cb..863119b6a2a8d 100644
> --- a/fs/ntfs3/super.c
> +++ b/fs/ntfs3/super.c
> @@ -690,6 +690,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
>  	struct buffer_head *bh;
>  	struct MFT_REC *rec;
>  	u16 fn, ao;
> +	const char *hint = "Primary boot";
>  
>  	sbi->volume.blocks = dev_size >> PAGE_SHIFT;
>  
> @@ -731,17 +732,24 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
>  	if (mlcn2 * sct_per_clst >= sectors)
>  		goto out;
>  
> -	/* Check MFT record size. */
> -	if ((boot->record_size < 0 &&
> -	     SECTOR_SIZE > (2U << (-boot->record_size))) ||
> -	    (boot->record_size >= 0 && !is_power_of_2(boot->record_size))) {
> +	if (boot->record_size >= 0) {
> +		record_size = (u32)boot->record_size << sbi->cluster_bits;
> +	} else if (-boot->record_size <= MAXIMUM_SHIFT_BYTES_PER_MFT) {
> +		record_size = 1u << (-boot->record_size);
> +	} else {
> +		ntfs_err(sb, "%s: invalid record size %d.", hint,
> +			 boot->record_size);
>  		goto out;
>  	}
>  
> -	/* Check index record size. */
> -	if ((boot->index_size < 0 &&
> -	     SECTOR_SIZE > (2U << (-boot->index_size))) ||
> -	    (boot->index_size >= 0 && !is_power_of_2(boot->index_size))) {
> +	sbi->record_size = record_size;
> +	sbi->record_bits = blksize_bits(record_size);
> +	sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes
> +
> +	/* Check MFT record size. */
> +	if (record_size < SECTOR_SIZE || !is_power_of_2(record_size)) {
> +		ntfs_err(sb, "%s: invalid bytes per MFT record %u (%d).", hint,
> +			 record_size, boot->record_size);
>  		goto out;
>  	}
>  
> @@ -784,26 +792,32 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
>  
>  	sbi->cluster_mask = sbi->cluster_size - 1;
>  	sbi->cluster_mask_inv = ~(u64)sbi->cluster_mask;
> -	sbi->record_size = record_size = boot->record_size < 0
> -						 ? 1 << (-boot->record_size)
> -						 : (u32)boot->record_size
> -							   << sbi->cluster_bits;
>  
>  	if (record_size > MAXIMUM_BYTES_PER_MFT || record_size < SECTOR_SIZE)
>  		goto out;
>  
> -	sbi->record_bits = blksize_bits(record_size);
> -	sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes
> +	if (boot->index_size >= 0) {
> +		sbi->index_size = (u32)boot->index_size << sbi->cluster_bits;
> +	} else if (-boot->index_size <= MAXIMUM_SHIFT_BYTES_PER_INDEX) {
> +		sbi->index_size = 1u << (-boot->index_size);
> +	} else {
> +		ntfs_err(sb, "%s: invalid index size %d.", hint,
> +			 boot->index_size);
> +		goto out;
> +	}
> +
> +	/* Check index record size. */
> +	if (sbi->index_size < SECTOR_SIZE || !is_power_of_2(sbi->index_size)) {
> +		ntfs_err(sb, "%s: invalid bytes per index %u(%d).", hint,
> +			 sbi->index_size, boot->index_size);
> +		goto out;
> +	}
>  
>  	sbi->max_bytes_per_attr =
>  		record_size - ALIGN(MFTRECORD_FIXUP_OFFSET_1, 8) -
>  		ALIGN(((record_size >> SECTOR_SHIFT) * sizeof(short)), 8) -
>  		ALIGN(sizeof(enum ATTR_TYPE), 8);
>  
> -	sbi->index_size = boot->index_size < 0
> -				  ? 1u << (-boot->index_size)
> -				  : (u32)boot->index_size << sbi->cluster_bits;
> -
>  	sbi->volume.ser_num = le64_to_cpu(boot->serial_num);
>  
>  	/* Warning if RAW volume. */
> -- 
> 2.34.1
>