git.openwrt.org Git - openwrt/openwrt.git/blob

   1 From 7af85d54e39733bb9a236b95ea5ed1ab8277d560 Mon Sep 17 00:00:00 2001
   2 From: Dom Cobley <popcornmix@gmail.com>
   3 Date: Tue, 11 Jun 2024 16:12:47 +0100
   4 Subject: [PATCH 1141/1145] fs/ntfs3: Fix memory corruption when page_size
   5  changes
   6
   7 The rework in fs/ntfs3: Reduce stack usage
   8 changes log->page_size but doesn't change the associated
   9 log->page_mask and log->page_bits.
  10
  11 That results in the bytes value in read_log_page
  12 getting a negative value, which is bad when it is
  13 passed to memcpy.
  14
  15 The kernel panic can be observed when connecting an
  16 ntfs formatted drive that has previously been connected
  17 to a Windows machine to a Raspberry Pi 5, which by defauilt
  18 uses a 16K kernel pagesize.
  19
  20 Fixes: 865e7a7700d9 ("fs/ntfs3: Reduce stack usage")
  21 Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  22 ---
  23  fs/ntfs3/fslog.c | 2 ++
  24  1 file changed, 2 insertions(+)
  25
  26 --- a/fs/ntfs3/fslog.c
  27 +++ b/fs/ntfs3/fslog.c
  28 @@ -3907,6 +3907,8 @@ check_restart_area:
  29                 log->l_size = log->orig_file_size;
  30                 log->page_size = norm_file_page(t32, &log->l_size,
  31                                                 t32 == DefaultLogPageSize);
  32 +               log->page_mask = log->page_size - 1;
  33 +               log->page_bits = blksize_bits(log->page_size);
  34         }
  35
  36         if (log->page_size != t32 ||