- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 025/107] fs/ntfs3: Potential NULL dereference in hdr_find_split()
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.15 commit 8c83a4851da1c7eda83098ade238665b15774da3 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- The "e" pointer is dereferenced before it has been checked for NULL. Move the dereference after the NULL check to prevent an Oops. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/index.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 5fb41c9c8910..f4729aa50671 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -557,11 +557,12 @@ static const struct NTFS_DE *hdr_find_split(const struct INDEX_HDR *hdr) size_t o; const struct NTFS_DE *e = hdr_first_de(hdr); u32 used_2 = le32_to_cpu(hdr->used) >> 1; - u16 esize = le16_to_cpu(e->size); + u16 esize; if (!e || de_is_last(e)) return NULL; + esize = le16_to_cpu(e->size); for (o = le32_to_cpu(hdr->de_off) + esize; o < used_2; o += esize) { const struct NTFS_DE *p = e; -- 2.30.0

1 0

[PATCH OLK-5.10 024/107] fs/ntfs3: Fix error code in indx_add_allocate()
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.15 commit 04810f000afdbdd37825ca7f563f036119422cb7 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Return -EINVAL if ni_find_attr() fails. Don't return success. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/index.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 334a3cef714b..5fb41c9c8910 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -1500,6 +1500,7 @@ static int indx_add_allocate(struct ntfs_index *indx, struct ntfs_inode *ni, alloc = ni_find_attr(ni, NULL, NULL, ATTR_ALLOC, in->name, in->name_len, NULL, &mi); if (!alloc) { + err = -EINVAL; if (bmp) goto out2; goto out1; -- 2.30.0

1 0

[PATCH OLK-5.10 023/107] fs/ntfs3: fix an error code in ntfs_get_acl_ex()
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.15 commit 2926e4297053c735ab65450192dfba32a4f47fa9 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- The ntfs_get_ea() function returns negative error codes or on success it returns the length. In the original code a zero length return was treated as -ENODATA and results in a NULL return. But it should be treated as an invalid length and result in an PTR_ERR(-EINVAL) return. Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c index af89e50f7b9f..d3d5b9d331d1 100644 --- a/fs/ntfs3/xattr.c +++ b/fs/ntfs3/xattr.c @@ -521,7 +521,7 @@ static struct posix_acl *ntfs_get_acl_ex(struct user_namespace *mnt_userns, ni_unlock(ni); /* Translate extended attribute to acl */ - if (err > 0) { + if (err >= 0) { acl = posix_acl_from_xattr(mnt_userns, buf, err); if (!IS_ERR(acl)) set_cached_acl(inode, type, acl); -- 2.30.0

1 0

[PATCH OLK-5.10 022/107] fs/ntfs3: add checks for allocation failure
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Dan Carpenter <dan.carpenter(a)oracle.com> mainline inclusion from mainline-v5.15 commit a1b04d380ab64790a7b4a8eb52e14679e47065ab category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Add a check for when the kzalloc() in init_rsttbl() fails. Some of the callers checked for NULL and some did not. I went down the call tree and added NULL checks where ever they were missing. Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/fslog.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index 2c213b55979e..7144ea8a9ab8 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -809,6 +809,9 @@ static inline struct RESTART_TABLE *init_rsttbl(u16 esize, u16 used) u32 lf = sizeof(struct RESTART_TABLE) + (used - 1) * esize; struct RESTART_TABLE *t = kzalloc(bytes, GFP_NOFS); + if (!t) + return NULL; + t->size = cpu_to_le16(esize); t->used = cpu_to_le16(used); t->free_goal = cpu_to_le32(~0u); @@ -831,7 +834,11 @@ static inline struct RESTART_TABLE *extend_rsttbl(struct RESTART_TABLE *tbl, u16 esize = le16_to_cpu(tbl->size); __le32 osize = cpu_to_le32(bytes_per_rt(tbl)); u32 used = le16_to_cpu(tbl->used); - struct RESTART_TABLE *rt = init_rsttbl(esize, used + add); + struct RESTART_TABLE *rt; + + rt = init_rsttbl(esize, used + add); + if (!rt) + return NULL; memcpy(rt + 1, tbl + 1, esize * used); @@ -864,8 +871,11 @@ static inline void *alloc_rsttbl_idx(struct RESTART_TABLE **tbl) __le32 *e; struct RESTART_TABLE *t = *tbl; - if (!t->first_free) + if (!t->first_free) { *tbl = t = extend_rsttbl(t, 16, ~0u); + if (!t) + return NULL; + } off = le32_to_cpu(t->first_free); @@ -4482,6 +4492,10 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) } dp = alloc_rsttbl_idx(&dptbl); + if (!dp) { + err = -ENOMEM; + goto out; + } dp->target_attr = cpu_to_le32(t16); dp->transfer_len = cpu_to_le32(t32 << sbi->cluster_bits); dp->lcns_follow = cpu_to_le32(t32); -- 2.30.0

1 0

[PATCH OLK-5.10 021/107] fs/ntfs3: Use kcalloc/kmalloc_array over kzalloc/kmalloc
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit 345482bc431f6492beb464696341626057f67771 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Use kcalloc/kmalloc_array over kzalloc/kmalloc when we allocate array. Checkpatch found these after we did not use our own defined allocation wrappers. Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/bitmap.c | 2 +- fs/ntfs3/file.c | 2 +- fs/ntfs3/frecord.c | 7 +++---- 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c index d502bba323d0..2de05062c78b 100644 --- a/fs/ntfs3/bitmap.c +++ b/fs/ntfs3/bitmap.c @@ -683,7 +683,7 @@ int wnd_init(struct wnd_bitmap *wnd, struct super_block *sb, size_t nbits) if (!wnd->bits_last) wnd->bits_last = wbits; - wnd->free_bits = kzalloc(wnd->nwnd * sizeof(u16), GFP_NOFS); + wnd->free_bits = kcalloc(wnd->nwnd, sizeof(u16), GFP_NOFS); if (!wnd->free_bits) return -ENOMEM; diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c index 8d27c520bec5..a959f6197c99 100644 --- a/fs/ntfs3/file.c +++ b/fs/ntfs3/file.c @@ -900,7 +900,7 @@ static ssize_t ntfs_compress_write(struct kiocb *iocb, struct iov_iter *from) return -EOPNOTSUPP; } - pages = kmalloc(pages_per_frame * sizeof(struct page *), GFP_NOFS); + pages = kmalloc_array(pages_per_frame, sizeof(struct page *), GFP_NOFS); if (!pages) return -ENOMEM; diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c index 2f7d16543530..329bc76dfb09 100644 --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -2054,7 +2054,7 @@ int ni_readpage_cmpr(struct ntfs_inode *ni, struct page *page) idx = (vbo - frame_vbo) >> PAGE_SHIFT; pages_per_frame = frame_size >> PAGE_SHIFT; - pages = kzalloc(pages_per_frame * sizeof(struct page *), GFP_NOFS); + pages = kcalloc(pages_per_frame, sizeof(struct page *), GFP_NOFS); if (!pages) { err = -ENOMEM; goto out; @@ -2137,7 +2137,7 @@ int ni_decompress_file(struct ntfs_inode *ni) frame_bits = ni_ext_compress_bits(ni); frame_size = 1u << frame_bits; pages_per_frame = frame_size >> PAGE_SHIFT; - pages = kzalloc(pages_per_frame * sizeof(struct page *), GFP_NOFS); + pages = kcalloc(pages_per_frame, sizeof(struct page *), GFP_NOFS); if (!pages) { err = -ENOMEM; goto out; @@ -2709,8 +2709,7 @@ int ni_write_frame(struct ntfs_inode *ni, struct page **pages, goto out; } - pages_disk = kzalloc(pages_per_frame * sizeof(struct page *), - GFP_NOFS); + pages_disk = kcalloc(pages_per_frame, sizeof(struct page *), GFP_NOFS); if (!pages_disk) { err = -ENOMEM; goto out; -- 2.30.0

1 0

[PATCH OLK-5.10 017/107] fs/ntfs3: Remove unused including <linux/version.h>
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com> mainline inclusion from mainline-v5.15 commit 1263eddfea9988125a4b9608efecc8aff2c721f9 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Eliminate the follow versioncheck warning: ./fs/ntfs3/inode.c: 16 linux/version.h not needed. Reported-by: Abaci Robot <abaci(a)linux.alibaba.com> Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Jiapeng Chong <jiapeng.chong(a)linux.alibaba.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/inode.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index a573c6e98cb8..ed64489edf73 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -13,7 +13,6 @@ #include <linux/namei.h> #include <linux/nls.h> #include <linux/uio.h> -#include <linux/version.h> #include <linux/writeback.h> #include "debug.h" -- 2.30.0

1 0

[PATCH OLK-5.10 016/107] fs/ntfs3: Fix fall-through warnings for Clang
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: "Gustavo A. R. Silva" <gustavoars(a)kernel.org> mainline inclusion from mainline-v5.15 commit abfeb2ee2103f07dd93b9d7b32317e26d1c8ef79 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Fix the following fallthrough warnings: fs/ntfs3/inode.c:1792:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] fs/ntfs3/index.c:178:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] This helps with the ongoing efforts to globally enable -Wimplicit-fallthrough for Clang. Link: https://github.com/KSPP/linux/issues/115 Signed-off-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Reviewed-by: Nathan Chancellor <nathan(a)kernel.org> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/index.c | 1 + fs/ntfs3/inode.c | 1 + 2 files changed, 2 insertions(+) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 9386c551e208..189d46e2c38d 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -175,6 +175,7 @@ static inline NTFS_CMP_FUNC get_cmp_func(const struct INDEX_ROOT *root) default: break; } + break; default: break; } diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index bf51e294432e..a573c6e98cb8 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -1789,6 +1789,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry) switch (err) { case 0: drop_nlink(inode); + break; case -ENOTEMPTY: case -ENOSPC: case -EROFS: -- 2.30.0

1 0

[PATCH OLK-5.10 015/107] fs/ntfs3: Fix one none utf8 char in source file
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Kari Argillander <kari.argillander(a)gmail.com> mainline inclusion from mainline-v5.15 commit be87e821fdb5ec8c6d404f29e118130c7879ce5b category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- In one source file there is for some reason non utf8 char. But hey this is fs development so this kind of thing might happen. Signed-off-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/frecord.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c index c3121bf9c62f..e377d72477df 100644 --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -1784,7 +1784,7 @@ enum REPARSE_SIGN ni_parse_reparse(struct ntfs_inode *ni, struct ATTRIB *attr, /* * WOF - Windows Overlay Filter - used to compress files with lzx/xpress * Unlike native NTFS file compression, the Windows Overlay Filter supports - * only read operations. This means that it doesn�t need to sector-align each + * only read operations. This means that it doesn't need to sector-align each * compressed chunk, so the compressed data can be packed more tightly together. * If you open the file for writing, the Windows Overlay Filter just decompresses * the entire file, turning it back into a plain file. -- 2.30.0

1 0

[PATCH OLK-5.10 014/107] fs/ntfs3: Remove unused variable cnt in ntfs_security_init()
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Nathan Chancellor <nathan(a)kernel.org> mainline inclusion from mainline-v5.15 commit 8c01308b6d6b2bc8e9163c6a3400856fb782dee6 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Clang warns: fs/ntfs3/fsntfs.c:1874:9: warning: variable 'cnt' set but not used [-Wunused-but-set-variable] size_t cnt, off; ^ 1 warning generated. It is indeed unused so remove it. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Nathan Chancellor <nathan(a)kernel.org> Reviewed-by: Nick Desaulniers <ndesaulniers(a)google.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/fsntfs.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c index 92140050fb6c..c6599c514acf 100644 --- a/fs/ntfs3/fsntfs.c +++ b/fs/ntfs3/fsntfs.c @@ -1871,7 +1871,7 @@ int ntfs_security_init(struct ntfs_sb_info *sbi) struct ATTRIB *attr; struct ATTR_LIST_ENTRY *le; u64 sds_size; - size_t cnt, off; + size_t off; struct NTFS_DE *ne; struct NTFS_DE_SII *sii_e; struct ntfs_fnd *fnd_sii = NULL; @@ -1946,7 +1946,6 @@ int ntfs_security_init(struct ntfs_sb_info *sbi) sbi->security.next_off = Quad2Align(sds_size - SecurityDescriptorsBlockSize); - cnt = 0; off = 0; ne = NULL; @@ -1964,8 +1963,6 @@ int ntfs_security_init(struct ntfs_sb_info *sbi) next_id = le32_to_cpu(sii_e->sec_id) + 1; if (next_id >= sbi->security.next_id) sbi->security.next_id = next_id; - - cnt += 1; } sbi->security.ni = ni; -- 2.30.0

1 0

[PATCH OLK-5.10 013/107] fs/ntfs3: Fix integer overflow in multiplication
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Colin Ian King <colin.king(a)canonical.com> mainline inclusion from mainline-v5.15 commit 71eeb6ace80be7389d942b9647765417e5b039f7 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- The multiplication of the u32 data_size with a int is being performed using 32 bit arithmetic however the results is being assigned to the variable nbits that is a size_t (64 bit) value. Fix a potential integer overflow by casting the u32 value to a size_t before the multiply to use a size_t sized bit multiply operation. Addresses-Coverity: ("Unintentional integer overflow") Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Colin Ian King <colin.king(a)canonical.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/index.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 6aa9540ece47..9386c551e208 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -2012,7 +2012,7 @@ static int indx_shrink(struct ntfs_index *indx, struct ntfs_inode *ni, unsigned long pos; const unsigned long *bm = resident_data(b); - nbits = le32_to_cpu(b->res.data_size) * 8; + nbits = (size_t)le32_to_cpu(b->res.data_size) * 8; if (bit >= nbits) return 0; -- 2.30.0

1 0