fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super

Reported-by: syzbot+478c1bf0e6bf4a8f3a04@syzkaller.appspotmail.com
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
index 629403ede6e5f1713cb1f063f354afaa62682c3c..788567d71d939a355ba34ddbbfa614897f2bb2c2 100644 (file)
--- a/fs/ntfs3/ntfs_fs.h
+++ b/fs/ntfs3/ntfs_fs.h
@@ -42,9 +42,11 @@ enum utf16_endian;
 #define MINUS_ONE_T                    ((size_t)(-1))
 /* Biggest MFT / smallest cluster */
 #define MAXIMUM_BYTES_PER_MFT          4096
+#define MAXIMUM_SHIFT_BYTES_PER_MFT    12
 #define NTFS_BLOCKS_PER_MFT_RECORD     (MAXIMUM_BYTES_PER_MFT / 512)
 
 #define MAXIMUM_BYTES_PER_INDEX                4096
+#define MAXIMUM_SHIFT_BYTES_PER_INDEX  12
 #define NTFS_BLOCKS_PER_INODE          (MAXIMUM_BYTES_PER_INDEX / 512)
 
 /* NTFS specific error code when fixup failed. */

diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index ea4e218c3f7553b0baed8e9ed8580e2cd8c42e4b..f78c67452b2a8c945ae531ab1186686dcb234892 100644 (file)
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -899,9 +899,17 @@ check_boot:
                goto out;
        }
 
-       sbi->record_size = record_size =
-               boot->record_size < 0 ? 1 << (-boot->record_size) :
-                                       (u32)boot->record_size << cluster_bits;
+       if (boot->record_size >= 0) {
+               record_size = (u32)boot->record_size << cluster_bits;
+       } else if (-boot->record_size <= MAXIMUM_SHIFT_BYTES_PER_MFT) {
+               record_size = 1u << (-boot->record_size);
+       } else {
+               ntfs_err(sb, "%s: invalid record size %d.", hint,
+                        boot->record_size);
+               goto out;
+       }
+
+       sbi->record_size = record_size;
        sbi->record_bits = blksize_bits(record_size);
        sbi->attr_size_tr = (5 * record_size >> 4); // ~320 bytes
 
@@ -918,9 +926,15 @@ check_boot:
                goto out;
        }
 
-       sbi->index_size = boot->index_size < 0 ?
-                                 1u << (-boot->index_size) :
-                                 (u32)boot->index_size << cluster_bits;
+       if (boot->index_size >= 0) {
+               sbi->index_size = (u32)boot->index_size << cluster_bits;
+       } else if (-boot->index_size <= MAXIMUM_SHIFT_BYTES_PER_INDEX) {
+               sbi->index_size = 1u << (-boot->index_size);
+       } else {
+               ntfs_err(sb, "%s: invalid index size %d.", hint,
+                        boot->index_size);
+               goto out;
+       }
 
        /* Check index record size. */
        if (sbi->index_size < SECTOR_SIZE || !is_power_of_2(sbi->index_size)) {