fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs
authorAbdun Nihaal <abdun.nihaal@gmail.com>
Sat, 1 Oct 2022 07:00:24 +0000 (12:30 +0530)
committerKonstantin Komarov <almaz.alexandrovich@paragon-software.com>
Sat, 12 Nov 2022 17:59:40 +0000 (20:59 +0300)
commit557d19675a470bb0a98beccec38c5dc3735c20fa
tree62058671befb7127e6cb36dcb000b45ff8885ff3
parentbfcdbae0523bd95eb75a739ffb6221a37109881e
fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs

Syzbot reports an out of bound access in ntfs_trim_fs.
The cause of this is using a loop termination condition that compares
window index (iw) with wnd->nbits instead of wnd->nwnd, due to which the
index used for wnd->free_bits exceeds the size of the array allocated.

Fix the loop condition.

Fixes: 3f3b442b5ad2 ("fs/ntfs3: Add bitmap")
Link: https://syzkaller.appspot.com/bug?extid=b892240eac461e488d51
Reported-by: syzbot+b892240eac461e488d51@syzkaller.appspotmail.com
Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3/bitmap.c