* [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
@ 2024-11-30 15:58 Nikita Zhandarovich
0 siblings, 0 replies; 5+ messages in thread
From: Nikita Zhandarovich @ 2024-11-30 15:58 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: Nikita Zhandarovich, Konstantin Komarov, ntfs3, linux-kernel,
lvc-project
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[Nikita: Fix for CVE-2024-27407 in 6.1.y. No changes were made
to get it to apply to older branch.]
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
---
fs/ntfs3/record.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 7ab452710572..826a756669a3 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -273,7 +273,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
if (t16 > asize)
return NULL;
- if (t16 + le32_to_cpu(attr->res.data_size) > asize)
+ if (le32_to_cpu(attr->res.data_size) > asize - t16)
return NULL;
if (attr->name_len &&
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
2024-12-09 6:52 [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr() jianqi.ren.cn
@ 2024-12-09 6:22 ` Greg KH
0 siblings, 0 replies; 5+ messages in thread
From: Greg KH @ 2024-12-09 6:22 UTC (permalink / raw)
To: jianqi.ren.cn; +Cc: almaz.alexandrovich, stable, ntfs3, linux-kernel
On Mon, Dec 09, 2024 at 02:52:23PM +0800, jianqi.ren.cn@windriver.com wrote:
> From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
>
> [ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
>
> Reported-by: Robert Morris <rtm@csail.mit.edu>
> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> Signed-off-by: Jianqi.ren.cn@windriver.com <jianqi.ren.cn@windriver.com>
You need a name here, not an email alias :(
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
@ 2024-12-09 6:52 jianqi.ren.cn
2024-12-09 6:22 ` Greg KH
0 siblings, 1 reply; 5+ messages in thread
From: jianqi.ren.cn @ 2024-12-09 6:52 UTC (permalink / raw)
To: gregkh, almaz.alexandrovich; +Cc: stable, ntfs3, linux-kernel
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Jianqi.ren.cn@windriver.com <jianqi.ren.cn@windriver.com>
---
fs/ntfs3/record.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 7ab452710572..826a756669a3 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -273,7 +273,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
if (t16 > asize)
return NULL;
- if (t16 + le32_to_cpu(attr->res.data_size) > asize)
+ if (le32_to_cpu(attr->res.data_size) > asize - t16)
return NULL;
if (attr->name_len &&
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
@ 2024-12-09 8:05 jianqi.ren.cn
0 siblings, 0 replies; 5+ messages in thread
From: jianqi.ren.cn @ 2024-12-09 8:05 UTC (permalink / raw)
To: gregkh, almaz.alexandrovich; +Cc: stable, ntfs3, linux-kernel
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
---
fs/ntfs3/record.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 7ab452710572..826a756669a3 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -273,7 +273,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
if (t16 > asize)
return NULL;
- if (t16 + le32_to_cpu(attr->res.data_size) > asize)
+ if (le32_to_cpu(attr->res.data_size) > asize - t16)
return NULL;
if (attr->name_len &&
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
@ 2024-12-11 10:08 jianqi.ren.cn
0 siblings, 0 replies; 5+ messages in thread
From: jianqi.ren.cn @ 2024-12-11 10:08 UTC (permalink / raw)
To: rtm, gregkh, almaz.alexandrovich; +Cc: patches, stable, ntfs3, linux-kernel
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
---
fs/ntfs3/record.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 7ab452710572..826a756669a3 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -273,7 +273,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
if (t16 > asize)
return NULL;
- if (t16 + le32_to_cpu(attr->res.data_size) > asize)
+ if (le32_to_cpu(attr->res.data_size) > asize - t16)
return NULL;
if (attr->name_len &&
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-12-11 9:10 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-12-09 6:52 [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr() jianqi.ren.cn
2024-12-09 6:22 ` Greg KH
-- strict thread matches above, loose matches on Subject: below --
2024-12-11 10:08 jianqi.ren.cn
2024-12-09 8:05 jianqi.ren.cn
2024-11-30 15:58 Nikita Zhandarovich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox