Konstantin Komarov (1): fs/ntfs3: Sequential field availability check in mi_enum_attr()
lei lu (1): ntfs3: Add bounds checking to mi_enum_attr()
fs/ntfs3/record.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
From: lei lu llfamsec@gmail.com
stable inclusion from stable-v6.6.60 commit 22cdf3be7d34f61a91b9e2966fec3a29f3871398 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AN CVE: CVE-2024-50248
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit 556bdf27c2dd5c74a9caacbe524b943a6cd42d99 ]
Added bounds checking to make sure that every attr don't stray beyond valid memory region.
Signed-off-by: lei lu llfamsec@gmail.com Signed-off-by: Konstantin Komarov almaz.alexandrovich@paragon-software.com Signed-off-by: Sasha Levin sashal@kernel.org
Conflicts: fs/ntfs3/record.c [Context differences.] Signed-off-by: Baokun Li libaokun1@huawei.com --- fs/ntfs3/record.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c index cc1aa626bb9e..44421f1f70e1 100644 --- a/fs/ntfs3/record.c +++ b/fs/ntfs3/record.c @@ -211,24 +211,19 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) prev_type = 0; attr = Add2Ptr(rec, off); } else { - /* Check if input attr inside record. */ + /* + * We don't need to check previous attr here. There is + * a bounds checking in the previous round. + */ off = PtrOffset(rec, attr); - if (off >= used) - return NULL;
asize = le32_to_cpu(attr->size); - if (asize < SIZEOF_RESIDENT) { - /* Impossible 'cause we should not return such attribute. */ - return NULL; - }
prev_type = le32_to_cpu(attr->type); attr = Add2Ptr(attr, asize); off += asize; }
- asize = le32_to_cpu(attr->size); - /* Can we use the first field (attr->type). */ if (off + 8 > used) { static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8); @@ -249,6 +244,12 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) if (t32 < prev_type) return NULL;
+ asize = le32_to_cpu(attr->size); + if (asize < SIZEOF_RESIDENT) { + /* Impossible 'cause we should not return such attribute. */ + return NULL; + } + /* Check boundary. */ if (off + asize > used) return NULL;
From: Konstantin Komarov almaz.alexandrovich@paragon-software.com
stable inclusion from stable-v6.6.60 commit cc082e50375a29596153fc3f1f8fc85ad1b0b5b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AN CVE: CVE-2024-50248
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
commit 090f612756a9720ec18b0b130e28be49839d7cb5 upstream.
The code is slightly reformatted to consistently check field availability without duplication.
Fixes: 556bdf27c2dd ("ntfs3: Add bounds checking to mi_enum_attr()") Signed-off-by: Konstantin Komarov almaz.alexandrovich@paragon-software.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
Conflicts: fs/ntfs3/record.c [Context differences.] Signed-off-by: Baokun Li libaokun1@huawei.com --- fs/ntfs3/record.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c index 44421f1f70e1..60ef03dc430c 100644 --- a/fs/ntfs3/record.c +++ b/fs/ntfs3/record.c @@ -225,6 +225,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) }
/* Can we use the first field (attr->type). */ + /* NOTE: this code also checks attr->size availability. */ if (off + 8 > used) { static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8); return NULL; @@ -245,10 +246,6 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) return NULL;
asize = le32_to_cpu(attr->size); - if (asize < SIZEOF_RESIDENT) { - /* Impossible 'cause we should not return such attribute. */ - return NULL; - }
/* Check boundary. */ if (off + asize > used) @@ -279,6 +276,10 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) if (attr->non_res != 1) return NULL;
+ /* Can we use memory including attr->nres.valid_size? */ + if (asize < SIZEOF_NONRESIDENT) + return NULL; + t16 = le16_to_cpu(attr->nres.run_off); if (t16 > asize) return NULL; @@ -305,7 +306,8 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
if (!attr->nres.svcn && is_attr_ext(attr)) { /* First segment of sparse/compressed attribute */ - if (asize + 8 < SIZEOF_NONRESIDENT_EX) + /* Can we use memory including attr->nres.total_size? */ + if (asize < SIZEOF_NONRESIDENT_EX) return NULL;
tot_size = le64_to_cpu(attr->nres.total_size); @@ -315,9 +317,6 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) if (tot_size > alloc_size) return NULL; } else { - if (asize + 8 < SIZEOF_NONRESIDENT) - return NULL; - if (attr->nres.c_unit) return NULL;
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://gitee.com/openeuler/kernel/pulls/13342 邮件列表地址：https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/A...
FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/13342 Mailing list address: https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/A...
-
Baokun Li -
patchwork bot