mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-06-03 18:32:28 -04:00
Code Issues Packages Projects Releases Wiki Activity

ntfs: validate attribute name bounds before returning it

Browse Source 
ntfs_attr_find() validates a named attribute before comparing it with the
requested name, but that check is currently after the AT_UNUSED handling.
When callers enumerate attributes with AT_UNUSED, ntfs_attr_find() can
return a malformed named attribute before checking whether name_offset
and name_length stay within the attribute record.

Some enumeration callers use the returned attribute name pointer
directly.  For example, one path passes (attr + name_offset, name_length)
to ntfs_attr_iget(), where the name can later be copied according to
name_length.  A malformed on-disk name_offset/name_length pair should not
be exposed to those callers.

Move the existing name bounds validation before returning attributes
during AT_UNUSED enumeration, and write it as an offset/remaining-size
check so the subtraction cannot underflow.  Extract the converted values
into local variables (name_offset, attr_len, name_size) to make the
intent explicit and avoid repeating the endian conversions inside the
bounds check.  This keeps matching attributes on the same checked path
while also covering attribute enumeration.

A small userspace ASAN model with attr length=32, name_offset=124 and
name_length=8 reproduces a heap-buffer-overflow read in the old
enumeration path.  With this change the same malformed attribute is
rejected before the name pointer is returned to the caller.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
This commit is contained in:
DaeMyung Kang
2026-05-09 15:12:37 +09:00
committed by Namjae Jeon
parent 679ee5afd5
commit b64f0ae5d4
1 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
fs/ntfs/attrib.c
View File

@@ -661,6 +661,9 @@ static int ntfs_attr_find(const __le32 type, const __le16 *name,
__le16 *upcase = vol->upcase;
u32 upcase_len = vol->upcase_len;
unsigned int space;
u16 name_offset;
u32 attr_len;
u32 name_size;
/*
* Iterate over attributes in mft record starting at @ctx->attr, or the
@@ -688,6 +691,20 @@ static int ntfs_attr_find(const __le32 type, const __le16 *name,
return -ENOENT;
if (unlikely(!a->length))
break;
if (a->name_length) {
name_offset = le16_to_cpu(a->name_offset);
attr_len = le32_to_cpu(a->length);
name_size = a->name_length * sizeof(__le16);
if (name_offset > attr_len ||
attr_len - name_offset < name_size) {
ntfs_error(vol->sb,
"Corrupt attribute name in MFT record %llu\n",
ctx->ntfs_ino->mft_no);
break;
}
}
if (type == AT_UNUSED)
return 0;
if (a->type != type)
@@ -701,14 +718,6 @@ static int ntfs_attr_find(const __le32 type, const __le16 *name,
if (a->name_length)
return -ENOENT;
} else {
if (a->name_length && ((le16_to_cpu(a->name_offset) +
a->name_length * sizeof(__le16)) >
le32_to_cpu(a->length))) {
ntfs_error(vol->sb, "Corrupt attribute name in MFT record %llu\n",
ctx->ntfs_ino->mft_no);
break;
}
if (!ntfs_are_names_equal(name, name_len,
(__le16 *)((u8 *)a + le16_to_cpu(a->name_offset)),
a->name_length, ic, upcase, upcase_len)) {