Commit a765caed authored by lei lu's avatar lei lu Committed by Wang Zhaolong
Browse files

fs/ntfs3: Validate ff offset 

mainline inclusion
from mainline-v6.10-rc1
commit 50c47879650b4c97836a0086632b3a2e300b0f06
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAG8RW
CVE: CVE-2024-41019

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=50c47879650b4c97836a0086632b3a2e300b0f06



--------------------------------

This adds sanity checks for ff offset. There is a check
on rt->first_free at first, but walking through by ff
without any check. If the second ff is a large offset.
We may encounter an out-of-bound read.

Signed-off-by: default avatarlei lu <llfamsec@gmail.com>
Signed-off-by: default avatarKonstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: default avatarWang Zhaolong <wangzhaolong1@huawei.com>
parent 98dea376

fs/ntfs3/fslog.c

+5 −1
Original line number Diff line number Diff line
@@ -722,7 +722,8 @@ static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes) 


	if (!rsize || rsize > bytes ||

	    rsize + sizeof(struct RESTART_TABLE) > bytes || bytes < ts ||

	    le16_to_cpu(rt->total) > ne || ff > ts || lf > ts ||

	    le16_to_cpu(rt->total) > ne ||

			ff > ts - sizeof(__le32) || lf > ts - sizeof(__le32) ||

	    (ff && ff < sizeof(struct RESTART_TABLE)) ||

	    (lf && lf < sizeof(struct RESTART_TABLE))) {

		return false;
@@ -752,6 +753,9 @@ static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes) 
			return false;



		off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));



		if (off > ts - sizeof(__le32))

			return false;

	}



	return true;