fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs
authorAbdun Nihaal <abdun.nihaal@gmail.com>
Sat, 1 Oct 2022 07:00:24 +0000 (12:30 +0530)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 31 Dec 2022 12:32:49 +0000 (13:32 +0100)
commitf2e58e95273ce072ca95a2afa1f274825a1e1772
treef9285e6db8f055a1a5690a09325852f8cadff2cc
parentcf66351484ad946faabb8de26faba37f0f124b58
fs/ntfs3: Fix slab-out-of-bounds read in ntfs_trim_fs

[ Upstream commit 557d19675a470bb0a98beccec38c5dc3735c20fa ]

Syzbot reports an out of bound access in ntfs_trim_fs.
The cause of this is using a loop termination condition that compares
window index (iw) with wnd->nbits instead of wnd->nwnd, due to which the
index used for wnd->free_bits exceeds the size of the array allocated.

Fix the loop condition.

Fixes: 3f3b442b5ad2 ("fs/ntfs3: Add bitmap")
Link: https://syzkaller.appspot.com/bug?extid=b892240eac461e488d51
Reported-by: syzbot+b892240eac461e488d51@syzkaller.appspotmail.com
Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/ntfs3/bitmap.c