public inbox for ntfs3@lists.linux.dev
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 6.11 01/20] ntfs3: Add bounds checking to mi_enum_attr()
@ 2024-10-14  3:57 Sasha Levin
  2024-10-14  3:57 ` [PATCH AUTOSEL 6.11 02/20] fs/ntfs3: Check if more than chunk-size bytes are written Sasha Levin
                   ` (7 more replies)
  0 siblings, 8 replies; 9+ messages in thread
From: Sasha Levin @ 2024-10-14  3:57 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: lei lu, Konstantin Komarov, Sasha Levin, ntfs3

From: lei lu <llfamsec@gmail.com>

[ Upstream commit 556bdf27c2dd5c74a9caacbe524b943a6cd42d99 ]

Added bounds checking to make sure that every attr don't stray beyond
valid memory region.

Signed-off-by: lei lu <llfamsec@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ntfs3/record.c | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 6c76503edc200..2a375247b3c09 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -223,28 +223,19 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 		prev_type = 0;
 		attr = Add2Ptr(rec, off);
 	} else {
-		/* Check if input attr inside record. */
+		/*
+		 * We don't need to check previous attr here. There is
+		 * a bounds checking in the previous round.
+		 */
 		off = PtrOffset(rec, attr);
-		if (off >= used)
-			return NULL;
 
 		asize = le32_to_cpu(attr->size);
-		if (asize < SIZEOF_RESIDENT) {
-			/* Impossible 'cause we should not return such attribute. */
-			return NULL;
-		}
-
-		/* Overflow check. */
-		if (off + asize < off)
-			return NULL;
 
 		prev_type = le32_to_cpu(attr->type);
 		attr = Add2Ptr(attr, asize);
 		off += asize;
 	}
 
-	asize = le32_to_cpu(attr->size);
-
 	/* Can we use the first field (attr->type). */
 	if (off + 8 > used) {
 		static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8);
@@ -265,6 +256,12 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 	if (t32 < prev_type)
 		return NULL;
 
+	asize = le32_to_cpu(attr->size);
+	if (asize < SIZEOF_RESIDENT) {
+		/* Impossible 'cause we should not return such attribute. */
+		return NULL;
+	}
+
 	/* Check overflow and boundary. */
 	if (off + asize < off || off + asize > used)
 		return NULL;
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2024-10-14  3:57 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-14  3:57 [PATCH AUTOSEL 6.11 01/20] ntfs3: Add bounds checking to mi_enum_attr() Sasha Levin
2024-10-14  3:57 ` [PATCH AUTOSEL 6.11 02/20] fs/ntfs3: Check if more than chunk-size bytes are written Sasha Levin
2024-10-14  3:57 ` [PATCH AUTOSEL 6.11 03/20] fs/ntfs3: Fix warning possible deadlock in ntfs_set_state Sasha Levin
2024-10-14  3:57 ` [PATCH AUTOSEL 6.11 04/20] fs/ntfs3: Stale inode instead of bad Sasha Levin
2024-10-14  3:57 ` [PATCH AUTOSEL 6.11 05/20] fs/ntfs3: Add rough attr alloc_size check Sasha Levin
2024-10-14  3:57 ` [PATCH AUTOSEL 6.11 06/20] fs/ntfs3: Fix possible deadlock in mi_read Sasha Levin
2024-10-14  3:57 ` [PATCH AUTOSEL 6.11 07/20] fs/ntfs3: Additional check in ni_clear() Sasha Levin
2024-10-14  3:57 ` [PATCH AUTOSEL 6.11 08/20] fs/ntfs3: Fix general protection fault in run_is_mapped_full Sasha Levin
2024-10-14  3:57 ` [PATCH AUTOSEL 6.11 09/20] fs/ntfs3: Additional check in ntfs_file_release Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox