Commit ba70e75e authored by Konstantin Komarov's avatar Konstantin Komarov Committed by Wen Zhiwei
Browse files

fs/ntfs3: Sequential field availability check in mi_enum_attr() 

stable inclusion
from stable-v6.6.60
commit cc082e50375a29596153fc3f1f8fc85ad1b0b5b9
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IB44K1

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=cc082e50375a29596153fc3f1f8fc85ad1b0b5b9



--------------------------------

commit 090f612756a9720ec18b0b130e28be49839d7cb5 upstream.

The code is slightly reformatted to consistently check field availability
without duplication.

Fixes: 556bdf27c2dd ("ntfs3: Add bounds checking to mi_enum_attr()")
Signed-off-by: default avatarKonstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent edec8c2f

fs/ntfs3/record.c

+7 −8
Original line number Diff line number Diff line
@@ -237,6 +237,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) 
	}



	/* Can we use the first field (attr->type). */

	/* NOTE: this code also checks attr->size availability. */

	if (off + 8 > used) {

		static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8);

		return NULL;
@@ -257,10 +258,6 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) 
		return NULL;



	asize = le32_to_cpu(attr->size);

	if (asize < SIZEOF_RESIDENT) {

		/* Impossible 'cause we should not return such attribute. */

		return NULL;

	}



	/* Check overflow and boundary. */

	if (off + asize < off || off + asize > used)
@@ -290,6 +287,10 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) 
	if (attr->non_res != 1)

		return NULL;



	/* Can we use memory including attr->nres.valid_size? */

	if (asize < SIZEOF_NONRESIDENT)

		return NULL;



	t16 = le16_to_cpu(attr->nres.run_off);

	if (t16 > asize)

		return NULL;
@@ -316,7 +317,8 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) 


	if (!attr->nres.svcn && is_attr_ext(attr)) {

		/* First segment of sparse/compressed attribute */

		if (asize + 8 < SIZEOF_NONRESIDENT_EX)

		/* Can we use memory including attr->nres.total_size? */

		if (asize < SIZEOF_NONRESIDENT_EX)

			return NULL;



		tot_size = le64_to_cpu(attr->nres.total_size);
@@ -326,9 +328,6 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) 
		if (tot_size > alloc_size)

			return NULL;

	} else {

		if (asize + 8 < SIZEOF_NONRESIDENT)

			return NULL;



		if (attr->nres.c_unit)

			return NULL;