diff options
| author | Abdun Nihaal <abdun.nihaal@gmail.com> | 2022-10-01 12:30:24 +0530 |
|---|---|---|
| committer | Konstantin Komarov <almaz.alexandrovich@paragon-software.com> | 2022-11-12 20:59:40 +0300 |
| commit | 557d19675a470bb0a98beccec38c5dc3735c20fa (patch) | |
| tree | 62058671befb7127e6cb36dcb000b45ff8885ff3 /fs/ntfs3 | |
| parent | bfcdbae0523bd95eb75a739ffb6221a37109881e (diff) | |
fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs
Syzbot reports an out of bound access in ntfs_trim_fs.
The cause of this is using a loop termination condition that compares
window index (iw) with wnd->nbits instead of wnd->nwnd, due to which the
index used for wnd->free_bits exceeds the size of the array allocated.
Fix the loop condition.
Fixes: 3f3b442b5ad2 ("fs/ntfs3: Add bitmap")
Link: https://syzkaller.appspot.com/bug?extid=b892240eac461e488d51
Reported-by: syzbot+b892240eac461e488d51@syzkaller.appspotmail.com
Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Diffstat (limited to 'fs/ntfs3')
| -rw-r--r-- | fs/ntfs3/bitmap.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c index 1675c9a69788..629c1ee97268 100644 --- a/fs/ntfs3/bitmap.c +++ b/fs/ntfs3/bitmap.c @@ -1424,7 +1424,7 @@ int ntfs_trim_fs(struct ntfs_sb_info *sbi, struct fstrim_range *range) down_read_nested(&wnd->rw_lock, BITMAP_MUTEX_CLUSTERS); - for (; iw < wnd->nbits; iw++, wbit = 0) { + for (; iw < wnd->nwnd; iw++, wbit = 0) { CLST lcn_wnd = iw * wbits; struct buffer_head *bh; |