[PATCH 5.15.y 5/7] fs/ntfs3: Add more checks in mi_enum_attr (part 2)
From: Sasha Levin <sashal@kernel.org>
Date: 2026-09-10 11:08:40
Subsystem:
filesystems (vfs and infrastructure), ntfs3 filesystem, the rest · Maintainers:
Alexander Viro, Christian Brauner, Konstantin Komarov, Linus Torvalds
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com> [ Upstream commit a8f659ce14f8f734894227ba2c5ca78c8451501e ] Add offset check before access to attr->non_res field as mentioned in [1]. [1] https://lore.kernel.org/ntfs3/20241010110005.42792-1-llfamsec@gmail.com/ (local) Suggested-by: lei lu <redacted> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com> Stable-dep-of: 7c4841e2a627 ("fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()") Signed-off-by: Sasha Levin <sashal@kernel.org> --- fs/ntfs3/record.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index e8d25f6ff15ed..76b12444633c5 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c@@ -207,7 +207,7 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi, return NULL; if (off >= used || off < MFTRECORD_FIXUP_OFFSET_1 || - !IS_ALIGNED(off, 4)) { + !IS_ALIGNED(off, 8)) { return NULL; }
@@ -231,8 +231,11 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi, off += asize; } - /* Can we use the first field (attr->type). */ - /* NOTE: this code also checks attr->size availability. */ + /* + * Can we use the first fields: + * attr->type, + * attr->size + */ if (off + 8 > used) { static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8); return NULL;
@@ -254,10 +257,17 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi, asize = le32_to_cpu(attr->size); + if (!IS_ALIGNED(asize, 8)) + return NULL; + /* Check overflow and boundary. */ if (off + asize < off || off + asize > used) return NULL; + /* Can we use the field attr->non_res. */ + if (off + 9 > used) + return NULL; + /* Check size of attribute. */ if (!attr->non_res) { /* Check resident fields. */
--
2.53.0