6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov almaz.alexandrovich@paragon-software.com
commit 090f612756a9720ec18b0b130e28be49839d7cb5 upstream.
The code is slightly reformatted to consistently check field availability without duplication.
Fixes: 556bdf27c2dd ("ntfs3: Add bounds checking to mi_enum_attr()") Signed-off-by: Konstantin Komarov almaz.alexandrovich@paragon-software.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ntfs3/record.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
--- a/fs/ntfs3/record.c +++ b/fs/ntfs3/record.c @@ -231,6 +231,7 @@ struct ATTRIB *mi_enum_attr(struct mft_i }
/* Can we use the first field (attr->type). */ + /* NOTE: this code also checks attr->size availability. */ if (off + 8 > used) { static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8); return NULL; @@ -251,10 +252,6 @@ struct ATTRIB *mi_enum_attr(struct mft_i return NULL;
asize = le32_to_cpu(attr->size); - if (asize < SIZEOF_RESIDENT) { - /* Impossible 'cause we should not return such attribute. */ - return NULL; - }
/* Check overflow and boundary. */ if (off + asize < off || off + asize > used) @@ -285,6 +282,10 @@ struct ATTRIB *mi_enum_attr(struct mft_i if (attr->non_res != 1) return NULL;
+ /* Can we use memory including attr->nres.valid_size? */ + if (asize < SIZEOF_NONRESIDENT) + return NULL; + t16 = le16_to_cpu(attr->nres.run_off); if (t16 > asize) return NULL; @@ -311,7 +312,8 @@ struct ATTRIB *mi_enum_attr(struct mft_i
if (!attr->nres.svcn && is_attr_ext(attr)) { /* First segment of sparse/compressed attribute */ - if (asize + 8 < SIZEOF_NONRESIDENT_EX) + /* Can we use memory including attr->nres.total_size? */ + if (asize < SIZEOF_NONRESIDENT_EX) return NULL;
tot_size = le64_to_cpu(attr->nres.total_size); @@ -321,9 +323,6 @@ struct ATTRIB *mi_enum_attr(struct mft_i if (tot_size > alloc_size) return NULL; } else { - if (asize + 8 < SIZEOF_NONRESIDENT) - return NULL; - if (attr->nres.c_unit) return NULL; }