dff5d77411
[ Upstream commit 4f8c94022f0bc3babd0a124c0a7dcdd7547bd94e ] Number of bytes allocated for mft record should be equal to the mft record size stored in ntfs superblock as reported by syzbot, userspace might trigger out-of-bounds read by dereferencing ctx->attr in ntfs_attr_find() Reported-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Tested-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com Acked-by: Anton Altaparmakov <anton@tuxera.com> Link: https://syzkaller.appspot.com/bug?extid=aed06913f36eff9b544e Link: https://lkml.kernel.org/r/20200824022804.226242-1-rkovhaev@gmail.com Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|---|---|---|
| .. | ||
| aops.c | ||
| aops.h | ||
| attrib.c | ||
| attrib.h | ||
| bitmap.c | ||
| bitmap.h | ||
| collate.c | ||
| collate.h | ||
| compress.c | ||
| debug.c | ||
| debug.h | ||
| dir.c | ||
| dir.h | ||
| endian.h | ||
| file.c | ||
| index.c | ||
| index.h | ||
| inode.c | ||
| inode.h | ||
| Kconfig | ||
| layout.h | ||
| lcnalloc.c | ||
| lcnalloc.h | ||
| logfile.c | ||
| logfile.h | ||
| Makefile | ||
| malloc.h | ||
| mft.c | ||
| mft.h | ||
| mst.c | ||
| namei.c | ||
| ntfs.h | ||
| quota.c | ||
| quota.h | ||
| runlist.c | ||
| runlist.h | ||
| super.c | ||
| sysctl.c | ||
| sysctl.h | ||
| time.h | ||
| types.h | ||
| unistr.c | ||
| upcase.c | ||
| usnjrnl.c | ||
| usnjrnl.h | ||
| volume.h | ||