[PATCH 6.1] ntfs3: Add bounds checking to mi_enum_attr() - Linux-stable-mirror

28 Nov 2024

From: lei lu llfamsec@gmail.com
[ Upstream commit 556bdf27c2dd5c74a9caacbe524b943a6cd42d99 ]
Added bounds checking to make sure that every attr don't stray beyond
valid memory region.
Signed-off-by: lei lu llfamsec@gmail.com
Signed-off-by: Konstantin Komarov almaz.alexandrovich@paragon-software.com
Signed-off-by: Bin Lan bin.lan.cn@windriver.com
---
 fs/ntfs3/record.c | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 7ab452710572..a332b925cb37 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -217,28 +217,19 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
    	prev_type = 0;
    	attr = Add2Ptr(rec, off);
    } else {
-		/* Check if input attr inside record. */
+		/*
+		 * We don't need to check previous attr here. There is
+		 * a bounds checking in the previous round.
+		 */
    	off = PtrOffset(rec, attr);
-		if (off >= used)
-			return NULL;
asize = le32_to_cpu(attr->size);
-		if (asize < SIZEOF_RESIDENT) {
-			/* Impossible 'cause we should not return such attribute. */
-			return NULL;
-		}
-
-		/* Overflow check. */
-		if (off + asize < off)
-			return NULL;
prev_type = le32_to_cpu(attr->type);
    	attr = Add2Ptr(attr, asize);
    	off += asize;
    }
-	asize = le32_to_cpu(attr->size);
-
    /* Can we use the first field (attr->type). */
    if (off + 8 > used) {
    	static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8);
@@ -259,6 +250,12 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
    if (t32 < prev_type)
    	return NULL;
+	asize = le32_to_cpu(attr->size);
+	if (asize < SIZEOF_RESIDENT) {
+		/* Impossible 'cause we should not return such attribute. */
+		return NULL;
+	}
+
    /* Check overflow and boundary. */
    if (off + asize < off || off + asize > used)
    	return NULL;
-- 
2.34.1



    