Unverified Commit 92ee711e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15724 CVE-2024-52560 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongjian Sun <sunyongjian1@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/PCW2Q3OZ4VGFFC4LVSCD46L53DC43C2D/ 
Konstantin Komarov (2):
  [Backport] fs/ntfs3: Mark inode as bad as soon as error detected in
    mi_enum_attr()
  [Backport] fs/ntfs3: Unify inode corruption marking with
    _ntfs_bad_inode()

 
https://gitee.com/src-openeuler/kernel/issues/IBPC5A 
 
Link:https://gitee.com/openeuler/kernel/pulls/15724

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 18622009 4e2c0735

fs/ntfs3/attrib.c

+7 −6
Original line number Diff line number Diff line
@@ -788,7 +788,8 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type, 
		if (err)

			goto out;



		attr = mi_find_attr(mi, NULL, type, name, name_len, &le->id);

		attr = mi_find_attr(ni, mi, NULL, type, name, name_len,

				    &le->id);

		if (!attr) {

			err = -EINVAL;

			goto bad_inode;
@@ -1182,7 +1183,7 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn, 
			goto out;

		}



		attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0, &le->id);

		attr = mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0, &le->id);

		if (!attr) {

			err = -EINVAL;

			goto out;
@@ -1420,7 +1421,7 @@ int attr_wof_frame_info(struct ntfs_inode *ni, struct ATTRIB *attr, 
	 */

	if (!attr->non_res) {

		if (vbo[1] + bytes_per_off > le32_to_cpu(attr->res.data_size)) {

			ntfs_inode_err(&ni->vfs_inode, "is corrupted");

			_ntfs_bad_inode(&ni->vfs_inode);

			return -EINVAL;

		}

		addr = resident_data(attr);
@@ -1809,7 +1810,7 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, 
				goto out;

			}



			attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0,

			attr = mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0,

					    &le->id);

			if (!attr) {

				err = -EINVAL;
@@ -2054,8 +2055,8 @@ int attr_collapse_range(struct ntfs_inode *ni, u64 vbo, u64 bytes) 
				}



				/* Look for required attribute. */

				attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL,

						    0, &le->id);

				attr = mi_find_attr(ni, mi, NULL, ATTR_DATA,

						    NULL, 0, &le->id);

				if (!attr) {

					err = -EINVAL;

					goto out;

fs/ntfs3/dir.c

+1 −1
Original line number Diff line number Diff line
@@ -512,7 +512,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx) 
		ctx->pos = pos;

	} else if (err < 0) {

		if (err == -EINVAL)

			ntfs_inode_err(dir, "directory corrupted");

			_ntfs_bad_inode(dir);

		ctx->pos = eod;

	}

fs/ntfs3/frecord.c

+38 −33
Original line number Diff line number Diff line
@@ -75,7 +75,7 @@ struct ATTR_STD_INFO *ni_std(struct ntfs_inode *ni) 
{

	const struct ATTRIB *attr;



	attr = mi_find_attr(&ni->mi, NULL, ATTR_STD, NULL, 0, NULL);

	attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_STD, NULL, 0, NULL);

	return attr ? resident_data_ex(attr, sizeof(struct ATTR_STD_INFO)) :

		      NULL;

}
@@ -89,7 +89,7 @@ struct ATTR_STD_INFO5 *ni_std5(struct ntfs_inode *ni) 
{

	const struct ATTRIB *attr;



	attr = mi_find_attr(&ni->mi, NULL, ATTR_STD, NULL, 0, NULL);

	attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_STD, NULL, 0, NULL);



	return attr ? resident_data_ex(attr, sizeof(struct ATTR_STD_INFO5)) :

		      NULL;
@@ -148,8 +148,10 @@ int ni_load_mi_ex(struct ntfs_inode *ni, CLST rno, struct mft_inode **mi) 
		goto out;



	err = mi_get(ni->mi.sbi, rno, &r);

	if (err)

	if (err) {

		_ntfs_bad_inode(&ni->vfs_inode);

		return err;

	}



	ni_add_mi(ni, r);
@@ -201,7 +203,8 @@ struct ATTRIB *ni_find_attr(struct ntfs_inode *ni, struct ATTRIB *attr, 
			*mi = &ni->mi;



		/* Look for required attribute in primary record. */

		return mi_find_attr(&ni->mi, attr, type, name, name_len, NULL);

		return mi_find_attr(ni, &ni->mi, attr, type, name, name_len,

				    NULL);

	}



	/* First look for list entry of required type. */
@@ -217,7 +220,7 @@ struct ATTRIB *ni_find_attr(struct ntfs_inode *ni, struct ATTRIB *attr, 
		return NULL;



	/* Look for required attribute. */

	attr = mi_find_attr(m, NULL, type, name, name_len, &le->id);

	attr = mi_find_attr(ni, m, NULL, type, name, name_len, &le->id);



	if (!attr)

		goto out;
@@ -238,8 +241,7 @@ struct ATTRIB *ni_find_attr(struct ntfs_inode *ni, struct ATTRIB *attr, 
	return attr;



out:

	ntfs_inode_err(&ni->vfs_inode, "failed to parse mft record");

	ntfs_set_state(ni->mi.sbi, NTFS_DIRTY_ERROR);

	_ntfs_bad_inode(&ni->vfs_inode);

	return NULL;

}
@@ -259,7 +261,7 @@ struct ATTRIB *ni_enum_attr_ex(struct ntfs_inode *ni, struct ATTRIB *attr, 
		if (mi)

			*mi = &ni->mi;

		/* Enum attributes in primary record. */

		return mi_enum_attr(&ni->mi, attr);

		return mi_enum_attr(ni, &ni->mi, attr);

	}



	/* Get next list entry. */
@@ -275,7 +277,7 @@ struct ATTRIB *ni_enum_attr_ex(struct ntfs_inode *ni, struct ATTRIB *attr, 
		*mi = mi2;



	/* Find attribute in loaded record. */

	return rec_find_attr_le(mi2, le2);

	return rec_find_attr_le(ni, mi2, le2);

}



/*
@@ -293,7 +295,8 @@ struct ATTRIB *ni_load_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, 
	if (!ni->attr_list.size) {

		if (pmi)

			*pmi = &ni->mi;

		return mi_find_attr(&ni->mi, NULL, type, name, name_len, NULL);

		return mi_find_attr(ni, &ni->mi, NULL, type, name, name_len,

				    NULL);

	}



	le = al_find_ex(ni, NULL, type, name, name_len, NULL);
@@ -319,7 +322,7 @@ struct ATTRIB *ni_load_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, 
	if (pmi)

		*pmi = mi;



	attr = mi_find_attr(mi, NULL, type, name, name_len, &le->id);

	attr = mi_find_attr(ni, mi, NULL, type, name, name_len, &le->id);

	if (!attr)

		return NULL;
@@ -330,6 +333,7 @@ struct ATTRIB *ni_load_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, 
	    vcn <= le64_to_cpu(attr->nres.evcn))

		return attr;



	_ntfs_bad_inode(&ni->vfs_inode);

	return NULL;

}
@@ -398,7 +402,8 @@ int ni_remove_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, 
	int diff;



	if (base_only || type == ATTR_LIST || !ni->attr_list.size) {

		attr = mi_find_attr(&ni->mi, NULL, type, name, name_len, id);

		attr = mi_find_attr(ni, &ni->mi, NULL, type, name, name_len,

				    id);

		if (!attr)

			return -ENOENT;
@@ -437,7 +442,7 @@ int ni_remove_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, 


		al_remove_le(ni, le);



		attr = mi_find_attr(mi, NULL, type, name, name_len, id);

		attr = mi_find_attr(ni, mi, NULL, type, name, name_len, id);

		if (!attr)

			return -ENOENT;
@@ -485,7 +490,7 @@ ni_ins_new_attr(struct ntfs_inode *ni, struct mft_inode *mi, 
		name = le->name;

	}



	attr = mi_insert_attr(mi, type, name, name_len, asize, name_off);

	attr = mi_insert_attr(ni, mi, type, name, name_len, asize, name_off);

	if (!attr) {

		if (le_added)

			al_remove_le(ni, le);
@@ -673,7 +678,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) 
	if (err)

		return err;



	attr_list = mi_find_attr(&ni->mi, NULL, ATTR_LIST, NULL, 0, NULL);

	attr_list = mi_find_attr(ni, &ni->mi, NULL, ATTR_LIST, NULL, 0, NULL);

	if (!attr_list)

		return 0;
@@ -695,7 +700,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) 
		if (!mi)

			return 0;



		attr = mi_find_attr(mi, NULL, le->type, le_name(le),

		attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le),

				    le->name_len, &le->id);

		if (!attr)

			return 0;
@@ -731,7 +736,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) 
			goto out;

		}



		attr = mi_find_attr(mi, NULL, le->type, le_name(le),

		attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le),

				    le->name_len, &le->id);

		if (!attr) {

			/* Should never happened, 'cause already checked. */
@@ -740,7 +745,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) 
		asize = le32_to_cpu(attr->size);



		/* Insert into primary record. */

		attr_ins = mi_insert_attr(&ni->mi, le->type, le_name(le),

		attr_ins = mi_insert_attr(ni, &ni->mi, le->type, le_name(le),

					  le->name_len, asize,

					  le16_to_cpu(attr->name_off));

		if (!attr_ins) {
@@ -768,7 +773,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) 
		if (!mi)

			continue;



		attr = mi_find_attr(mi, NULL, le->type, le_name(le),

		attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le),

				    le->name_len, &le->id);

		if (!attr)

			continue;
@@ -831,7 +836,7 @@ int ni_create_attr_list(struct ntfs_inode *ni) 
	free_b = 0;

	attr = NULL;



	for (; (attr = mi_enum_attr(&ni->mi, attr)); le = Add2Ptr(le, sz)) {

	for (; (attr = mi_enum_attr(ni, &ni->mi, attr)); le = Add2Ptr(le, sz)) {

		sz = le_size(attr->name_len);

		le->type = attr->type;

		le->size = cpu_to_le16(sz);
@@ -886,7 +891,7 @@ int ni_create_attr_list(struct ntfs_inode *ni) 
		u32 asize = le32_to_cpu(b->size);

		u16 name_off = le16_to_cpu(b->name_off);



		attr = mi_insert_attr(mi, b->type, Add2Ptr(b, name_off),

		attr = mi_insert_attr(ni, mi, b->type, Add2Ptr(b, name_off),

				      b->name_len, asize, name_off);

		if (!attr)

			goto out;
@@ -909,7 +914,7 @@ int ni_create_attr_list(struct ntfs_inode *ni) 
			goto out;

	}



	attr = mi_insert_attr(&ni->mi, ATTR_LIST, NULL, 0,

	attr = mi_insert_attr(ni, &ni->mi, ATTR_LIST, NULL, 0,

			      lsize + SIZEOF_RESIDENT, SIZEOF_RESIDENT);

	if (!attr)

		goto out;
@@ -993,13 +998,13 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, 
		mi = rb_entry(node, struct mft_inode, node);



		if (is_mft_data &&

		    (mi_enum_attr(mi, NULL) ||

		    (mi_enum_attr(ni, mi, NULL) ||

		     vbo <= ((u64)mi->rno << sbi->record_bits))) {

			/* We can't accept this record 'cause MFT's bootstrapping. */

			continue;

		}

		if (is_mft &&

		    mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0, NULL)) {

		    mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0, NULL)) {

			/*

			 * This child record already has a ATTR_DATA.

			 * So it can't accept any other records.
@@ -1008,7 +1013,7 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, 
		}



		if ((type != ATTR_NAME || name_len) &&

		    mi_find_attr(mi, NULL, type, name, name_len, NULL)) {

		    mi_find_attr(ni, mi, NULL, type, name, name_len, NULL)) {

			/* Only indexed attributes can share same record. */

			continue;

		}
@@ -1157,7 +1162,7 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, 
	/* Estimate the result of moving all possible attributes away. */

	attr = NULL;



	while ((attr = mi_enum_attr(&ni->mi, attr))) {

	while ((attr = mi_enum_attr(ni, &ni->mi, attr))) {

		if (attr->type == ATTR_STD)

			continue;

		if (attr->type == ATTR_LIST)
@@ -1175,7 +1180,7 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, 
	attr = NULL;



	for (;;) {

		attr = mi_enum_attr(&ni->mi, attr);

		attr = mi_enum_attr(ni, &ni->mi, attr);

		if (!attr) {

			/* We should never be here 'cause we have already check this case. */

			err = -EINVAL;
@@ -1259,7 +1264,7 @@ static int ni_expand_mft_list(struct ntfs_inode *ni) 
	for (node = rb_first(&ni->mi_tree); node; node = rb_next(node)) {

		mi = rb_entry(node, struct mft_inode, node);



		attr = mi_enum_attr(mi, NULL);

		attr = mi_enum_attr(ni, mi, NULL);



		if (!attr) {

			mft_min = mi->rno;
@@ -1280,7 +1285,7 @@ static int ni_expand_mft_list(struct ntfs_inode *ni) 
		ni_remove_mi(ni, mi_new);

	}



	attr = mi_find_attr(&ni->mi, NULL, ATTR_DATA, NULL, 0, NULL);

	attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_DATA, NULL, 0, NULL);

	if (!attr) {

		err = -EINVAL;

		goto out;
@@ -1397,7 +1402,7 @@ int ni_expand_list(struct ntfs_inode *ni) 
			continue;



		/* Find attribute in primary record. */

		attr = rec_find_attr_le(&ni->mi, le);

		attr = rec_find_attr_le(ni, &ni->mi, le);

		if (!attr) {

			err = -EINVAL;

			goto out;
@@ -1604,8 +1609,8 @@ int ni_delete_all(struct ntfs_inode *ni) 
		roff = le16_to_cpu(attr->nres.run_off);



		if (roff > asize) {

			_ntfs_bad_inode(&ni->vfs_inode);

			return -EINVAL;

			/* ni_enum_attr_ex checks this case. */

			continue;

		}



		/* run==1 means unpack and deallocate. */
@@ -3344,7 +3349,7 @@ int ni_write_inode(struct inode *inode, int sync, const char *hint) 
		if (!mi->dirty)

			continue;



		is_empty = !mi_enum_attr(mi, NULL);

		is_empty = !mi_enum_attr(ni, mi, NULL);



		if (is_empty)

			clear_rec_inuse(mi->mrec);

fs/ntfs3/fsntfs.c

+5 −1
Original line number Diff line number Diff line
@@ -908,8 +908,12 @@ void ntfs_bad_inode(struct inode *inode, const char *hint) 


	ntfs_inode_err(inode, "%s", hint);

	make_bad_inode(inode);

	/* Avoid recursion if bad inode is $Volume. */

	if (inode->i_ino != MFT_REC_VOL &&

	    !(sbi->flags & NTFS_FLAGS_LOG_REPLAYING)) {

		ntfs_set_state(sbi, NTFS_DIRTY_ERROR);

	}

}



/*

 * ntfs_set_state

fs/ntfs3/index.c

+2 −4
Original line number Diff line number Diff line
@@ -1094,8 +1094,7 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn, 


ok:

	if (!index_buf_check(ib, bytes, &vbn)) {

		ntfs_inode_err(&ni->vfs_inode, "directory corrupted");

		ntfs_set_state(ni->mi.sbi, NTFS_DIRTY_ERROR);

		_ntfs_bad_inode(&ni->vfs_inode);

		err = -EINVAL;

		goto out;

	}
@@ -1117,8 +1116,7 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn, 


out:

	if (err == -E_NTFS_CORRUPT) {

		ntfs_inode_err(&ni->vfs_inode, "directory corrupted");

		ntfs_set_state(ni->mi.sbi, NTFS_DIRTY_ERROR);

		_ntfs_bad_inode(&ni->vfs_inode);

		err = -EINVAL;

	}