From nobody Tue Sep 16 20:06:05 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22FC7C4167B for ; Fri, 30 Dec 2022 11:25:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234813AbiL3LZy (ORCPT ); Fri, 30 Dec 2022 06:25:54 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34574 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234788AbiL3LZv (ORCPT ); Fri, 30 Dec 2022 06:25:51 -0500 Received: from relayaws-01.paragon-software.com (relayaws-01.paragon-software.com [35.157.23.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 467BCC6A; Fri, 30 Dec 2022 03:25:51 -0800 (PST) Received: from dlg2.mail.paragon-software.com (vdlg-exch-02.paragon-software.com [172.30.1.105]) by relayaws-01.paragon-software.com (Postfix) with ESMTPS id B4A8220EE; Fri, 30 Dec 2022 11:22:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paragon-software.com; s=mail; t=1672399336; bh=snwY2+VKm0LsKlpAvdxmC463EUj3w2PVok9aOOZl/rI=; h=Date:Subject:From:To:CC:References:In-Reply-To; b=rRz9SCjfJ8B7V/kgmkjToZKbuXssEC25O8lWLZ7lBJJaL4VBHMap3MRnA10pXH3UK FJhG5btOP2lonbcl2n+UtyprUXZcCL7aLFJrezIUIqyieXDKpz0p8jL8ffTZ7yYj3S kyzwnKco+Bqq3u3sx0ASikQ8HsGeHW0Sgl6xfGCI= Received: from [192.168.211.146] (192.168.211.146) by vdlg-exch-02.paragon-software.com (172.30.1.105) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.7; Fri, 30 Dec 2022 14:25:48 +0300 Message-ID: <4628ae8a-39e9-ecf8-3efe-193a1ad14d23@paragon-software.com> Date: Fri, 30 Dec 2022 15:25:48 +0400 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.6.0 Subject: [PATCH 3/5] fs/ntfs3: Check for extremely large size of $AttrDef Content-Language: en-US From: Konstantin Komarov To: CC: , References: In-Reply-To: Content-Type: text/plain; charset="utf-8"; format="flowed" Content-Transfer-Encoding: quoted-printable X-Originating-IP: [192.168.211.146] X-ClientProxiedBy: vobn-exch-01.paragon-software.com (172.30.72.13) To vdlg-exch-02.paragon-software.com (172.30.1.105) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Added additional checking for size of $AttrDef. Added comment. Signed-off-by: Konstantin Komarov --- =C2=A0fs/ntfs3/super.c | 10 +++++++++- =C2=A01 file changed, 9 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index ef4ea3f21905..0967035146ce 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -1185,10 +1185,18 @@ static int ntfs_fill_super(struct super_block=20 *sb, struct fs_context *fc) =C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 goto out; =C2=A0=C2=A0=C2=A0=C2=A0 } -=C2=A0=C2=A0=C2=A0 if (inode->i_size < sizeof(struct ATTR_DEF_ENTRY)) { +=C2=A0=C2=A0=C2=A0 /* +=C2=A0=C2=A0=C2=A0 =C2=A0* Typical $AttrDef contains up to 20 entries. +=C2=A0=C2=A0=C2=A0 =C2=A0* Check for extremely large size. +=C2=A0=C2=A0=C2=A0 =C2=A0*/ +=C2=A0=C2=A0=C2=A0 if (inode->i_size < sizeof(struct ATTR_DEF_ENTRY) || +=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 inode->i_size > 100 * sizeof(struct = ATTR_DEF_ENTRY)) { +=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 ntfs_err(sb, "Looks like $AttrDef is= corrupted (size=3D%llu).", +=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =C2=A0inode->i_si= ze); =C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 err =3D -EINVAL; =C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 goto put_inode_out; =C2=A0=C2=A0=C2=A0=C2=A0 } + =C2=A0=C2=A0=C2=A0=C2=A0 bytes =3D inode->i_size; =C2=A0=C2=A0=C2=A0=C2=A0 sbi->def_table =3D t =3D kmalloc(bytes, GFP_NOFS = | __GFP_NOWARN); =C2=A0=C2=A0=C2=A0=C2=A0 if (!t) { --=20 2.34.1