public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
@ 2024-11-30 15:58 Nikita Zhandarovich
  0 siblings, 0 replies; 11+ messages in thread
From: Nikita Zhandarovich @ 2024-11-30 15:58 UTC (permalink / raw)
  To: Greg Kroah-Hartman, stable
  Cc: Nikita Zhandarovich, Konstantin Komarov, ntfs3, linux-kernel,
	lvc-project

From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]

Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
[Nikita: Fix for CVE-2024-27407 in 6.1.y. No changes were made
to get it to apply to older branch.]
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
---
 fs/ntfs3/record.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 7ab452710572..826a756669a3 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -273,7 +273,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 		if (t16 > asize)
 			return NULL;
 
-		if (t16 + le32_to_cpu(attr->res.data_size) > asize)
+		if (le32_to_cpu(attr->res.data_size) > asize - t16)
 			return NULL;
 
 		if (attr->name_len &&
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re: [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
  2024-12-04  3:29 jianqi.ren.cn
@ 2024-12-04  2:44 ` Sasha Levin
  2024-12-11  8:16 ` Greg KH
  1 sibling, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2024-12-04  2:44 UTC (permalink / raw)
  To: stable; +Cc: jianqi.ren.cn, Sasha Levin

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 652cfeb43d6b9aba5c7c4902bed7a7340df131fb

WARNING: Author mismatch between patch and upstream commit:
Backport author: <jianqi.ren.cn@windriver.com>
Commit author: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.11.y | Present (exact SHA1)
6.6.y | Present (different SHA1: 8c77398c7261)
6.1.y | Present (different SHA1: 7cfa8ae94ffa)

Note: The patch differs from the upstream commit:
---
1:  652cfeb43d6b9 ! 1:  310681bc6d92e fs/ntfs3: Fixed overflow check in mi_enum_attr()
    @@ Metadata
      ## Commit message ##
         fs/ntfs3: Fixed overflow check in mi_enum_attr()
     
    +    [ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
    +
         Reported-by: Robert Morris <rtm@csail.mit.edu>
         Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
    +    Signed-off-by: Sasha Levin <sashal@kernel.org>
    +    Signed-off-by: Jianqi.ren.cn@windriver.com <jianqi.ren.cn@windriver.com>
     
      ## fs/ntfs3/record.c ##
     @@ fs/ntfs3/record.c: struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
    @@ fs/ntfs3/record.c: struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTR
     +		if (le32_to_cpu(attr->res.data_size) > asize - t16)
      			return NULL;
      
    - 		t32 = sizeof(short) * attr->name_len;
    + 		if (attr->name_len &&
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
@ 2024-12-04  3:29 jianqi.ren.cn
  2024-12-04  2:44 ` Sasha Levin
  2024-12-11  8:16 ` Greg KH
  0 siblings, 2 replies; 11+ messages in thread
From: jianqi.ren.cn @ 2024-12-04  3:29 UTC (permalink / raw)
  To: gregkh, almaz.alexandrovich; +Cc: stable

From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]

Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Jianqi.ren.cn@windriver.com <jianqi.ren.cn@windriver.com>
---
 fs/ntfs3/record.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 7ab452710572..826a756669a3 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -273,7 +273,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 		if (t16 > asize)
 			return NULL;
 
-		if (t16 + le32_to_cpu(attr->res.data_size) > asize)
+		if (le32_to_cpu(attr->res.data_size) > asize - t16)
 			return NULL;
 
 		if (attr->name_len &&
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re: [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
  2024-12-09  6:52 jianqi.ren.cn
@ 2024-12-09  6:22 ` Greg KH
  2024-12-09 14:35 ` Sasha Levin
  1 sibling, 0 replies; 11+ messages in thread
From: Greg KH @ 2024-12-09  6:22 UTC (permalink / raw)
  To: jianqi.ren.cn; +Cc: almaz.alexandrovich, stable, ntfs3, linux-kernel

On Mon, Dec 09, 2024 at 02:52:23PM +0800, jianqi.ren.cn@windriver.com wrote:
> From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
> 
> [ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
> 
> Reported-by: Robert Morris <rtm@csail.mit.edu>
> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> Signed-off-by: Jianqi.ren.cn@windriver.com <jianqi.ren.cn@windriver.com>

You need a name here, not an email alias :(

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
@ 2024-12-09  6:52 jianqi.ren.cn
  2024-12-09  6:22 ` Greg KH
  2024-12-09 14:35 ` Sasha Levin
  0 siblings, 2 replies; 11+ messages in thread
From: jianqi.ren.cn @ 2024-12-09  6:52 UTC (permalink / raw)
  To: gregkh, almaz.alexandrovich; +Cc: stable, ntfs3, linux-kernel

From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]

Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Jianqi.ren.cn@windriver.com <jianqi.ren.cn@windriver.com>
---
 fs/ntfs3/record.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 7ab452710572..826a756669a3 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -273,7 +273,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 		if (t16 > asize)
 			return NULL;
 
-		if (t16 + le32_to_cpu(attr->res.data_size) > asize)
+		if (le32_to_cpu(attr->res.data_size) > asize - t16)
 			return NULL;
 
 		if (attr->name_len &&
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
@ 2024-12-09  8:05 jianqi.ren.cn
  2024-12-09 14:35 ` Sasha Levin
  0 siblings, 1 reply; 11+ messages in thread
From: jianqi.ren.cn @ 2024-12-09  8:05 UTC (permalink / raw)
  To: gregkh, almaz.alexandrovich; +Cc: stable, ntfs3, linux-kernel

From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]

Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
---
 fs/ntfs3/record.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 7ab452710572..826a756669a3 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -273,7 +273,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 		if (t16 > asize)
 			return NULL;
 
-		if (t16 + le32_to_cpu(attr->res.data_size) > asize)
+		if (le32_to_cpu(attr->res.data_size) > asize - t16)
 			return NULL;
 
 		if (attr->name_len &&
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re: [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
  2024-12-09  6:52 jianqi.ren.cn
  2024-12-09  6:22 ` Greg KH
@ 2024-12-09 14:35 ` Sasha Levin
  1 sibling, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2024-12-09 14:35 UTC (permalink / raw)
  To: stable; +Cc: jianqi.ren.cn, Sasha Levin

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 652cfeb43d6b9aba5c7c4902bed7a7340df131fb

WARNING: Author mismatch between patch and upstream commit:
Backport author: <jianqi.ren.cn@windriver.com>
Commit author: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.6.y | Present (different SHA1: 8c77398c7261)
6.1.y | Present (different SHA1: be684526fad4)

Note: The patch differs from the upstream commit:
---
1:  652cfeb43d6b9 ! 1:  77aacf84111d3 fs/ntfs3: Fixed overflow check in mi_enum_attr()
    @@ Metadata
      ## Commit message ##
         fs/ntfs3: Fixed overflow check in mi_enum_attr()
     
    +    [ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
    +
         Reported-by: Robert Morris <rtm@csail.mit.edu>
         Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
    +    Signed-off-by: Sasha Levin <sashal@kernel.org>
    +    Signed-off-by: Jianqi.ren.cn@windriver.com <jianqi.ren.cn@windriver.com>
     
      ## fs/ntfs3/record.c ##
     @@ fs/ntfs3/record.c: struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
    @@ fs/ntfs3/record.c: struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTR
     +		if (le32_to_cpu(attr->res.data_size) > asize - t16)
      			return NULL;
      
    - 		t32 = sizeof(short) * attr->name_len;
    + 		if (attr->name_len &&
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
  2024-12-09  8:05 [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr() jianqi.ren.cn
@ 2024-12-09 14:35 ` Sasha Levin
  0 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2024-12-09 14:35 UTC (permalink / raw)
  To: stable; +Cc: jianqi.ren.cn, Sasha Levin

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 652cfeb43d6b9aba5c7c4902bed7a7340df131fb

WARNING: Author mismatch between patch and upstream commit:
Backport author: <jianqi.ren.cn@windriver.com>
Commit author: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.6.y | Present (different SHA1: 8c77398c7261)
6.1.y | Present (different SHA1: be684526fad4)

Note: The patch differs from the upstream commit:
---
1:  652cfeb43d6b9 ! 1:  54afaabeb65a8 fs/ntfs3: Fixed overflow check in mi_enum_attr()
    @@ Metadata
      ## Commit message ##
         fs/ntfs3: Fixed overflow check in mi_enum_attr()
     
    +    [ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
    +
         Reported-by: Robert Morris <rtm@csail.mit.edu>
         Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
    +    Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
     
      ## fs/ntfs3/record.c ##
     @@ fs/ntfs3/record.c: struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
    @@ fs/ntfs3/record.c: struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTR
     +		if (le32_to_cpu(attr->res.data_size) > asize - t16)
      			return NULL;
      
    - 		t32 = sizeof(short) * attr->name_len;
    + 		if (attr->name_len &&
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
  2024-12-04  3:29 jianqi.ren.cn
  2024-12-04  2:44 ` Sasha Levin
@ 2024-12-11  8:16 ` Greg KH
  1 sibling, 0 replies; 11+ messages in thread
From: Greg KH @ 2024-12-11  8:16 UTC (permalink / raw)
  To: jianqi.ren.cn; +Cc: almaz.alexandrovich, stable

On Wed, Dec 04, 2024 at 11:29:13AM +0800, jianqi.ren.cn@windriver.com wrote:
> From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
> 
> [ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]

Please cc: all relevant people on backports.

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
@ 2024-12-11 10:08 jianqi.ren.cn
  2024-12-11 16:32 ` Sasha Levin
  0 siblings, 1 reply; 11+ messages in thread
From: jianqi.ren.cn @ 2024-12-11 10:08 UTC (permalink / raw)
  To: rtm, gregkh, almaz.alexandrovich; +Cc: patches, stable, ntfs3, linux-kernel

From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]

Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
---
 fs/ntfs3/record.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 7ab452710572..826a756669a3 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -273,7 +273,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 		if (t16 > asize)
 			return NULL;
 
-		if (t16 + le32_to_cpu(attr->res.data_size) > asize)
+		if (le32_to_cpu(attr->res.data_size) > asize - t16)
 			return NULL;
 
 		if (attr->name_len &&
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re: [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr()
  2024-12-11 10:08 jianqi.ren.cn
@ 2024-12-11 16:32 ` Sasha Levin
  0 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2024-12-11 16:32 UTC (permalink / raw)
  To: stable; +Cc: jianqi.ren.cn, Sasha Levin

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 652cfeb43d6b9aba5c7c4902bed7a7340df131fb

WARNING: Author mismatch between patch and upstream commit:
Backport author: <jianqi.ren.cn@windriver.com>
Commit author: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.6.y | Present (different SHA1: 8c77398c7261)
6.1.y | Present (different SHA1: 41a5b35ed3d9)

Note: The patch differs from the upstream commit:
---
1:  652cfeb43d6b9 ! 1:  b719631ac9586 fs/ntfs3: Fixed overflow check in mi_enum_attr()
    @@ Metadata
      ## Commit message ##
         fs/ntfs3: Fixed overflow check in mi_enum_attr()
     
    +    [ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
    +
         Reported-by: Robert Morris <rtm@csail.mit.edu>
         Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
    +    Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
     
      ## fs/ntfs3/record.c ##
     @@ fs/ntfs3/record.c: struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
    @@ fs/ntfs3/record.c: struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTR
     +		if (le32_to_cpu(attr->res.data_size) > asize - t16)
      			return NULL;
      
    - 		t32 = sizeof(short) * attr->name_len;
    + 		if (attr->name_len &&
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |

^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2024-12-11 16:32 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-12-09  8:05 [PATCH 6.1.y] fs/ntfs3: Fixed overflow check in mi_enum_attr() jianqi.ren.cn
2024-12-09 14:35 ` Sasha Levin
  -- strict thread matches above, loose matches on Subject: below --
2024-12-11 10:08 jianqi.ren.cn
2024-12-11 16:32 ` Sasha Levin
2024-12-09  6:52 jianqi.ren.cn
2024-12-09  6:22 ` Greg KH
2024-12-09 14:35 ` Sasha Levin
2024-12-04  3:29 jianqi.ren.cn
2024-12-04  2:44 ` Sasha Levin
2024-12-11  8:16 ` Greg KH
2024-11-30 15:58 Nikita Zhandarovich

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox