linux/fs
Rustam Kovhaev 4f8c94022f ntfs: add check for mft record size in superblock
Number of bytes allocated for mft record should be equal to the mft record
size stored in ntfs superblock as reported by syzbot, userspace might
trigger out-of-bounds read by dereferencing ctx->attr in ntfs_attr_find()

Reported-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com
Acked-by: Anton Altaparmakov <anton@tuxera.com>
Link: https://syzkaller.appspot.com/bug?extid=aed06913f36eff9b544e
Link: https://lkml.kernel.org/r/20200824022804.226242-1-rkovhaev@gmail.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-10-13 18:38:27 -07:00
..
9p bdi: replace BDI_CAP_NO_{WRITEBACK,ACCT_DIRTY} with a single flag 2020-09-24 13:43:39 -06:00
adfs treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
affs affs: fix basic permission bits to actually work 2020-08-31 12:20:31 +02:00
afs block-5.10-2020-10-12 2020-10-13 12:12:44 -07:00
autofs autofs: use __kernel_write() for the autofs pipe writing 2020-09-29 17:18:34 -07:00
befs block: move struct block_device to blk_types.h 2020-06-24 09:16:02 -06:00
bfs
btrfs block-5.10-2020-10-12 2020-10-13 12:12:44 -07:00
cachefiles cachefiles: switch to kernel_write 2020-07-08 08:27:56 +02:00
ceph We have an inode number handling change, prompted by s390x which is 2020-08-28 10:33:04 -07:00
cifs cifs: Fix incomplete memory allocation on setxattr path 2020-10-10 15:52:54 -07:00
coda docs: filesystems: convert coda.txt to ReST 2020-05-05 09:22:21 -06:00
configfs treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
cramfs
crypto fscrypt: export fscrypt_d_revalidate() 2020-09-28 14:44:51 -07:00
debugfs debugfs: Fix module state check condition 2020-09-04 18:12:52 +02:00
devpts
dlm dlm for 5.10 2020-10-13 08:59:39 -07:00
ecryptfs mm, treewide: rename kzfree() to kfree_sensitive() 2020-08-07 11:33:22 -07:00
efivarfs efivarfs: Replace invalid slashes with exclamation marks in dentries. 2020-09-25 23:29:04 +02:00
efs block: move struct block_device to blk_types.h 2020-06-24 09:16:02 -06:00
erofs erofs: remove unnecessary enum entries 2020-10-09 10:37:42 +08:00
exfat exfat: fix use of uninitialized spinlock on error path 2020-10-07 14:27:13 +09:00
exportfs
ext2 ext2: don't update mtime on COW faults 2020-09-05 10:00:05 -07:00
ext4 fscrypt: make fscrypt_set_test_dummy_encryption() take a 'const char *' 2020-09-22 06:48:52 -07:00
f2fs fscrypt updates for 5.10 2020-10-13 08:54:00 -07:00
fat fat: fix fat_ra_init() for data clusters == 0 2020-08-12 10:58:01 -07:00
freevxfs
fscache Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next 2020-06-03 16:27:18 -07:00
fuse block-5.10-2020-10-12 2020-10-13 12:12:44 -07:00
gfs2 Fix memory leak on filesystem withdraw 2020-08-28 10:41:00 -07:00
hfs block: move block-related definitions out of fs.h 2020-06-24 09:16:02 -06:00
hfsplus treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
hostfs
hpfs hpfs: fix warning due to superfluous semicolon 2020-06-06 10:08:17 -07:00
hugetlbfs hugetlbfs: prevent filesystem stacking of hugetlbfs 2020-08-12 10:57:56 -07:00
iomap treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
isofs Remove uninitialized_var() macro for v5.9-rc1 2020-08-04 13:49:43 -07:00
jbd2 jbd2: clean up checksum verification in do_one_pass() 2020-08-19 12:04:35 -04:00
jffs2 treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
jfs block: move struct block_device to blk_types.h 2020-06-24 09:16:02 -06:00
kernfs fsnotify: pass dir and inode arguments to fsnotify() 2020-07-27 23:15:48 +02:00
lockd
minix fs/minix: remove expected error message in block_to_path() 2020-08-12 10:58:00 -07:00
nfs block-5.10-2020-10-12 2020-10-13 12:12:44 -07:00
nfs_common treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
nfsd block: add a bdev_is_partition helper 2020-09-25 08:18:57 -06:00
nilfs2 treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
nls treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
notify treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
ntfs ntfs: add check for mft record size in superblock 2020-10-13 18:38:27 -07:00
ocfs2 ocfs2: cleanup o2hb_region_dev_store 2020-09-23 10:43:19 -06:00
omfs treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
openpromfs
orangefs orangefs: remove unnecessary assignment to variable ret 2020-08-04 15:01:58 -04:00
overlayfs Remove uninitialized_var() macro for v5.9-rc1 2020-08-04 13:49:43 -07:00
proc arm64: mte: Add PROT_MTE support to mmap() and mprotect() 2020-09-04 12:46:07 +01:00
pstore treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
qnx4
qnx6 fs: convert mpage_readpages to mpage_readahead 2020-06-02 10:59:07 -07:00
quota Merge branch 'work.quota-compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-10-12 16:37:13 -07:00
ramfs
reiserfs \n 2020-08-06 19:28:26 -07:00
romfs romfs: fix uninitialized memory leak in romfs_dev_read() 2020-08-21 09:52:53 -07:00
squashfs squashfs: avoid bio_alloc() failure with 1Mbyte blocks 2020-08-21 09:52:53 -07:00
sysfs RDMA 5.8 merge window pull request 2020-06-05 14:05:57 -07:00
sysv
tracefs
ubifs block-5.10-2020-10-12 2020-10-13 12:12:44 -07:00
udf treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
ufs treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
unicode
vboxsf block-5.10-2020-10-12 2020-10-13 12:12:44 -07:00
verity fs-verity: use smp_load_acquire() for ->i_verity_info 2020-07-21 16:02:41 -07:00
xfs Fixes (2) for 5.9: 2020-09-05 10:04:53 -07:00
zonefs zonefs: add zone-capacity support 2020-08-11 17:42:24 +09:00
aio.c Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-10-12 16:35:51 -07:00
anon_inodes.c
attr.c
bad_inode.c fs: move the fiemap definitions out of fs.h 2020-06-03 23:16:55 -04:00
binfmt_aout.c exec: Rename flush_old_exec begin_new_exec 2020-05-07 16:55:47 -05:00
binfmt_elf_fdpic.c Merge branch 'work.fdpic' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-08-07 13:29:39 -07:00
binfmt_elf.c kill elf_fpxregs_t 2020-07-27 14:29:23 -04:00
binfmt_em86.c Merge branch 'akpm' (patches from Andrew) 2020-06-04 19:18:29 -07:00
binfmt_flat.c binfmt_flat: revert "binfmt_flat: don't offset the data start" 2020-08-24 08:49:13 +10:00
binfmt_misc.c Merge branch 'akpm' (patches from Andrew) 2020-06-04 19:18:29 -07:00
binfmt_script.c Merge branch 'akpm' (patches from Andrew) 2020-06-04 19:18:29 -07:00
block_dev.c block: add a bdget_part helper 2020-10-05 10:38:33 -06:00
buffer.c fs: Don't invalidate page buffers in block_write_full_page() 2020-09-07 10:23:07 -06:00
char_dev.c vfs: allow unprivileged whiteout creation 2020-05-14 16:44:23 +02:00
compat_binfmt_elf.c Split the old READ_IMPLIES_EXEC workaround from executable PT_GNU_STACK 2020-06-05 13:45:21 -07:00
coredump.c coredump: add %f for executable filename 2020-08-12 10:58:01 -07:00
d_path.c
dax.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
dcache.c vfs: Use sequence counter with associated spinlock 2020-07-29 16:14:27 +02:00
dcookies.c
direct-io.c fs: remove no longer used dio_end_io() 2020-10-07 12:17:59 +02:00
drop_caches.c
eventfd.c eventfd: convert to f_op->read_iter() 2020-05-06 22:33:43 -04:00
eventpoll.c ep_create_wakeup_source(): dentry name can change under you... 2020-09-24 19:41:58 -04:00
exec.c io_uring: don't rely on weak ->files references 2020-09-30 20:32:32 -06:00
fcntl.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
fhandle.c
file_table.c Revert "fs: Do not check if there is a fsnotify watcher on pseudo inodes" 2020-06-29 09:40:55 -07:00
file.c io_uring: don't rely on weak ->files references 2020-09-30 20:32:32 -06:00
filesystems.c
fs_context.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
fs_parser.c
fs_pin.c
fs_struct.c vfs: Use sequence counter with associated spinlock 2020-07-29 16:14:27 +02:00
fs_types.c
fs-writeback.c block-5.10-2020-10-12 2020-10-13 12:12:44 -07:00
fsopen.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
init.c init: add an init_dup helper 2020-08-04 21:02:38 -04:00
inode.c AFS Changes 2020-06-05 16:26:36 -07:00
internal.h fs: remove compat_sys_mount 2020-09-22 23:45:57 -04:00
io_uring.c io_uring-5.10-2020-10-12 2020-10-13 12:36:21 -07:00
io-wq.c io-wq: kill unused IO_WORKER_F_EXITING 2020-09-30 20:32:34 -06:00
io-wq.h io_uring: add blkcg accounting to offloaded operations 2020-09-30 20:32:34 -06:00
ioctl.c fs: remove ksys_ioctl 2020-07-31 08:16:01 +02:00
Kconfig tmpfs: support 64-bit inums per-sb 2020-08-07 11:33:24 -07:00
Kconfig.binfmt treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
libfs.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
locks.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
Makefile fs: remove compat_sys_mount 2020-09-22 23:45:57 -04:00
mbcache.c
mount.h proc/mounts: add cursor 2020-05-14 16:44:24 +02:00
mpage.c fs: convert mpage_readpages to mpage_readahead 2020-06-02 10:59:07 -07:00
namei.c fs: remove the unused SB_I_MULTIROOT flag 2020-09-24 13:43:38 -06:00
namespace.c Merge branch 'compat.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-10-12 16:44:57 -07:00
no-block.c
nsfs.c nsproxy: attach to namespaces via pidfds 2020-05-13 11:41:22 +02:00
open.c exec: move S_ISREG() check earlier 2020-08-12 10:58:01 -07:00
pipe.c Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-10-11 11:11:35 -07:00
pnode.c
pnode.h
posix_acl.c vfs: clean up posix_acl_permission() logic aroudn MAY_NOT_BLOCK 2020-06-08 11:04:19 -07:00
proc_namespace.c Merge branch 'proc-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2020-06-04 13:54:34 -07:00
read_write.c Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-10-12 16:35:51 -07:00
readdir.c fs: remove ksys_getdents64 2020-07-31 08:16:00 +02:00
select.c pselect6() and friends: take handling the combined 6th/7th args into helper 2020-05-29 19:10:42 -04:00
seq_file.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
signalfd.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
splice.c Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-10-12 16:35:51 -07:00
stack.c
stat.c New code for 5.8: 2020-06-02 19:45:12 -07:00
statfs.c
super.c bdi: replace BDI_CAP_STABLE_WRITES with a queue and a sb flag 2020-09-24 13:43:39 -06:00
sync.c overlayfs update for 5.8 2020-06-09 15:40:50 -07:00
timerfd.c
userfaultfd.c A set of locking fixes and updates: 2020-08-10 19:07:44 -07:00
utimes.c fs: expose utimes_common 2020-07-31 08:16:01 +02:00
xattr.c xattr: add a function to check if a namespace is supported 2020-07-13 17:27:03 -04:00