ntfs: remove redundant out-of-bound checks

Remove redundant out-of-bounds validations. Since ntfs_attr_find and ntfs_external_attr_find now validate the attribute value offsets and lengths against the bounds of the MFT record block, performing subsequent bounds checking in caller functions like ntfs_attr_lookup is no longer necessary.

Hyunchul Lee committed 8 months ago

Commit 14f0a131 parent a198a0c3 files · +0 −42Browse files

Unified · Split

3 files

fs/ntfs/inode.c +0 −28
fs/ntfs/namei.c +0 −8
fs/ntfs/super.c +0 −6

fs/ntfs/inode.c+0−28

@@ -757,12 +757,6 @@ static int ntfs_read_locked_inode(struct inode *vi) · 756 unmodified lines
757	757	}
758	758	a = ctx->attr;
759	759	/* Get the standard information attribute value. */
760		− if ((u8 *)a + le16_to_cpu(a->data.resident.value_offset)
761		− + le32_to_cpu(a->data.resident.value_length) >
762		− (u8 *)ctx->mrec + vol->mft_record_size) {
763		− ntfs_error(vi->i_sb, "Corrupt standard information attribute in inode.");
764		− goto unm_err_out;
765		− }
766	760	si = (struct standard_information )((u8 )a +
767	761	le16_to_cpu(a->data.resident.value_offset));
768	762
@@ -849,13 +843,6 @@ static int ntfs_read_locked_inode(struct inode *vi) · 80 unmodified lines
849	843	goto unm_err_out;
850	844	}
851	845	} else /* if (!a->non_resident) */ {
852		− if ((u8 *)a + le16_to_cpu(a->data.resident.value_offset)
853		− + le32_to_cpu(
854		− a->data.resident.value_length) >
855		− (u8 *)ctx->mrec + vol->mft_record_size) {
856		− ntfs_error(vi->i_sb, "Corrupt attribute list in inode.");
857		− goto unm_err_out;
858		− }
859	846	/* Now copy the attribute list. */
860	847	memcpy(ni->attr_list, (u8 *)a + le16_to_cpu(
861	848	a->data.resident.value_offset),
@@ -954,10 +941,6 @@ view_index_meta: · 92 unmodified lines
954	941	ir = (struct index_root )((u8 )a +
955	942	le16_to_cpu(a->data.resident.value_offset));
956	943	ir_end = (u8 *)ir + le32_to_cpu(a->data.resident.value_length);
957		− if (ir_end > (u8 *)ctx->mrec + vol->mft_record_size) {
958		− ntfs_error(vi->i_sb, "$INDEX_ROOT attribute is corrupt.");
959		− goto unm_err_out;
960		− }
961	944	index_end = (u8 *)&ir->index +
962	945	le32_to_cpu(ir->index.index_length);
963	946	if (index_end > ir_end) {
@@ -1552,10 +1535,6 @@ static int ntfs_read_locked_index_inode(struct inode base_vi, struct inode vi) · 588 unmodified lines
1552	1535
1553	1536	ir = (struct index_root )((u8 )a + le16_to_cpu(a->data.resident.value_offset));
1554	1537	ir_end = (u8 *)ir + le32_to_cpu(a->data.resident.value_length);
1555		− if (ir_end > (u8 *)ctx->mrec + vol->mft_record_size) {
1556		− ntfs_error(vi->i_sb, "$INDEX_ROOT attribute is corrupt.");
1557		− goto unm_err_out;
1558		− }
1559	1538	index_end = (u8 *)&ir->index + le32_to_cpu(ir->index.index_length);
1560	1539	if (index_end > ir_end) {
1561	1540	ntfs_error(vi->i_sb, "Index is corrupt.");
@@ -1999,13 +1978,6 @@ int ntfs_read_inode_mount(struct inode *vi) · 437 unmodified lines
1999	1978	goto put_err_out;
2000	1979	}
2001	1980	} else /* if (!ctx.attr->non_resident) */ {
2002		− if ((u8 *)a + le16_to_cpu(
2003		− a->data.resident.value_offset) +
2004		− le32_to_cpu(a->data.resident.value_length) >
2005		− (u8 *)ctx->mrec + vol->mft_record_size) {
2006		− ntfs_error(sb, "Corrupt attribute list attribute.");
2007		− goto put_err_out;
2008		− }
2009	1981	/* Now copy the attribute list. */
2010	1982	memcpy(ni->attr_list, (u8 *)a + le16_to_cpu(
2011	1983	a->data.resident.value_offset),

fs/ntfs/namei.c+0−8

@@ -274,7 +274,6 @@ handle_name: · 273 unmodified lines
274	274	}
275	275	do {
276	276	struct attr_record *a;
277		− u32 val_len;
278	277
279	278	err = ntfs_attr_lookup(AT_FILE_NAME, NULL, 0, 0, 0,
280	279	NULL, 0, ctx);
@@ -289,15 +288,8 @@ handle_name: · 8 unmodified lines
289	288	a = ctx->attr;
290	289	if (a->non_resident \|\| a->flags)
291	290	goto eio_err_out;
292		− val_len = le32_to_cpu(a->data.resident.value_length);
293		− if (le16_to_cpu(a->data.resident.value_offset) +
294		− val_len > le32_to_cpu(a->length))
295		− goto eio_err_out;
296	291	fn = (struct file_name_attr )((u8 )ctx->attr + le16_to_cpu(
297	292	ctx->attr->data.resident.value_offset));
298		− if ((u32)(fn->file_name_length * sizeof(__le16) +
299		− sizeof(struct file_name_attr)) > val_len)
300		− goto eio_err_out;
301	293	} while (fn->file_name_type != FILE_NAME_WIN32);
302	294
303	295	/* Convert the found WIN32 name to current NLS code page. */

fs/ntfs/super.c+0−6

@@ -1512,7 +1512,6 @@ iput_volume_failed: · 1511 unmodified lines
1512	1512
1513	1513	if (ntfs_attr_lookup(AT_VOLUME_INFORMATION, NULL, 0, 0, 0, NULL, 0,
1514	1514	ctx) \|\| ctx->attr->non_resident \|\| ctx->attr->flags) {
1515		−err_put_vol:
1516	1515	ntfs_attr_put_search_ctx(ctx);
1517	1516	get_ctx_vol_failed:
1518	1517	unmap_mft_record(NTFS_I(vol->vol_ino));
@@ -1520,11 +1519,6 @@ get_ctx_vol_failed: · 1 unmodified line
1520	1519	}
1521	1520	vi = (struct volume_information )((char )ctx->attr +
1522	1521	le16_to_cpu(ctx->attr->data.resident.value_offset));
1523		− /* Some bounds checks. */
1524		− if ((u8 )vi < (u8 )ctx->attr \|\| (u8 *)vi +
1525		− le32_to_cpu(ctx->attr->data.resident.value_length) >
1526		− (u8 *)ctx->attr + le32_to_cpu(ctx->attr->length))
1527		− goto err_put_vol;
1528	1522	/* Copy the volume flags and version to the struct ntfs_volume structure. */
1529	1523	vol->vol_flags = vi->flags;
1530	1524	vol->major_ver = vi->major_ver;