Messages in this thread | | | Date | Mon, 26 Dec 2022 19:45:59 +0400 | Subject | Re: [PATCH] fs/ntfs3: Fix slab-out-of-bounds in ntfs_trim_fs() | From | Konstantin Komarov <> |
| |
On 30.11.2022 18:57, Shigeru Yoshida wrote: > ntfs_trim_fs() should loop with wnd->nwnd, not wnd->nbits. KASAN > detects this as an out-of-bounds access like below: > > ================================================================== > BUG: KASAN: slab-out-of-bounds in ntfs_trim_fs (fs/ntfs3/bitmap.c:1434) > Read of size 2 at addr ffff8881745b4f02 by task repro/19678 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-2.fc37 04/01/2014 > Call Trace: > <TASK> > dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) > print_report (mm/kasan/report.c:285 mm/kasan/report.c:395) > ? __virt_addr_valid (arch/x86/mm/physaddr.c:66) > ? __phys_addr (arch/x86/mm/physaddr.c:32 (discriminator 4)) > ? ntfs_trim_fs (fs/ntfs3/bitmap.c:1434) > ? ntfs_trim_fs (fs/ntfs3/bitmap.c:1434) > kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:497) > ? ntfs_trim_fs (fs/ntfs3/bitmap.c:1434) > ntfs_trim_fs (fs/ntfs3/bitmap.c:1434) > ntfs_ioctl (fs/ntfs3/file.c:41 fs/ntfs3/file.c:57) > ? ntfs_fiemap (fs/ntfs3/file.c:51) > ? bpf_lsm_file_ioctl (./include/linux/lsm_hook_defs.h:165) > ? ntfs_fiemap (fs/ntfs3/file.c:51) > __x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:870 fs/ioctl.c:856 fs/ioctl.c:856) > do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) > entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) > > Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> > --- > fs/ntfs3/bitmap.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c > index e92bbd754365..1930640be31a 100644 > --- a/fs/ntfs3/bitmap.c > +++ b/fs/ntfs3/bitmap.c > @@ -1424,7 +1424,7 @@ int ntfs_trim_fs(struct ntfs_sb_info *sbi, struct fstrim_range *range) > > down_read_nested(&wnd->rw_lock, BITMAP_MUTEX_CLUSTERS); > > - for (; iw < wnd->nbits; iw++, wbit = 0) { > + for (; iw < wnd->nwnd; iw++, wbit = 0) { > CLST lcn_wnd = iw * wbits; > struct buffer_head *bh; >
Thanks for work, this bug has already been fixed:
https://lore.kernel.org/ntfs3/20221001070024.1366018-1-abdun.nihaal@gmail.com/
| |