From: Konstantin Komarov almaz.alexandrovich@paragon-software.com
[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
Reported-by: Robert Morris rtm@csail.mit.edu Signed-off-by: Konstantin Komarov almaz.alexandrovich@paragon-software.com Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: Jianqi.ren.cn@windriver.com jianqi.ren.cn@windriver.com --- fs/ntfs3/record.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c index 7ab452710572..826a756669a3 100644 --- a/fs/ntfs3/record.c +++ b/fs/ntfs3/record.c @@ -273,7 +273,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) if (t16 > asize) return NULL;
- if (t16 + le32_to_cpu(attr->res.data_size) > asize) + if (le32_to_cpu(attr->res.data_size) > asize - t16) return NULL;
if (attr->name_len &&
[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 652cfeb43d6b9aba5c7c4902bed7a7340df131fb
WARNING: Author mismatch between patch and upstream commit: Backport author: jianqi.ren.cn@windriver.com Commit author: Konstantin Komarov almaz.alexandrovich@paragon-software.com
Status in newer kernel trees: 6.12.y | Present (exact SHA1) 6.11.y | Present (exact SHA1) 6.6.y | Present (different SHA1: 8c77398c7261) 6.1.y | Present (different SHA1: 7cfa8ae94ffa)
Note: The patch differs from the upstream commit: --- 1: 652cfeb43d6b9 ! 1: 310681bc6d92e fs/ntfs3: Fixed overflow check in mi_enum_attr() @@ Metadata ## Commit message ## fs/ntfs3: Fixed overflow check in mi_enum_attr()
+ [ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ] + Reported-by: Robert Morris rtm@csail.mit.edu Signed-off-by: Konstantin Komarov almaz.alexandrovich@paragon-software.com + Signed-off-by: Sasha Levin sashal@kernel.org + Signed-off-by: Jianqi.ren.cn@windriver.com jianqi.ren.cn@windriver.com
## fs/ntfs3/record.c ## @@ fs/ntfs3/record.c: struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) @@ fs/ntfs3/record.c: struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTR + if (le32_to_cpu(attr->res.data_size) > asize - t16) return NULL;
- t32 = sizeof(short) * attr->name_len; + if (attr->name_len && ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-6.1.y | Success | Success |
On Wed, Dec 04, 2024 at 11:29:13AM +0800, jianqi.ren.cn@windriver.com wrote:
From: Konstantin Komarov almaz.alexandrovich@paragon-software.com
[ Upstream commit 652cfeb43d6b9aba5c7c4902bed7a7340df131fb ]
Please cc: all relevant people on backports.
linux-stable-mirror@lists.linaro.org
-
Greg KH -
jianqi.ren.cn＠windriver.com -
Sasha Levin