History

ntfs: remove redundant out-of-bound checks

Remove redundant out-of-bounds validations. Since ntfs_attr_find and ntfs_external_attr_find now validate the attribute value offsets and lengths against the bounds of the MFT record block, performing subsequent bounds checking in caller functions like ntfs_attr_lookup is no longer necessary.

Hyunchul Lee committed 8 months ago

Commit 14f0a131 parent a198a0c3 files · +0 −42Browse files

Unified · Split

3 files
  1. fs/ntfs/inode.c +0 −28
  2. fs/ntfs/namei.c +0 −8
  3. fs/ntfs/super.c +0 −6
fs/ntfs/inode.c+0−28
@@ -757,12 +757,6 @@ static int ntfs_read_locked_inode(struct inode *vi) · 756 unmodified lines
757 }757 }
758 a = ctx->attr;758 a = ctx->attr;
759 /* Get the standard information attribute value. */759 /* Get the standard information attribute value. */
760 if ((u8 *)a + le16_to_cpu(a->data.resident.value_offset)
761 + le32_to_cpu(a->data.resident.value_length) >
762 (u8 *)ctx->mrec + vol->mft_record_size) {
763 ntfs_error(vi->i_sb, "Corrupt standard information attribute in inode.");
764 goto unm_err_out;
765 }
766 si = (struct standard_information *)((u8 *)a +760 si = (struct standard_information *)((u8 *)a +
767 le16_to_cpu(a->data.resident.value_offset));761 le16_to_cpu(a->data.resident.value_offset));
768 762
@@ -849,13 +843,6 @@ static int ntfs_read_locked_inode(struct inode *vi) · 80 unmodified lines
849 goto unm_err_out;843 goto unm_err_out;
850 }844 }
851 } else /* if (!a->non_resident) */ {845 } else /* if (!a->non_resident) */ {
852 if ((u8 *)a + le16_to_cpu(a->data.resident.value_offset)
853 + le32_to_cpu(
854 a->data.resident.value_length) >
855 (u8 *)ctx->mrec + vol->mft_record_size) {
856 ntfs_error(vi->i_sb, "Corrupt attribute list in inode.");
857 goto unm_err_out;
858 }
859 /* Now copy the attribute list. */846 /* Now copy the attribute list. */
860 memcpy(ni->attr_list, (u8 *)a + le16_to_cpu(847 memcpy(ni->attr_list, (u8 *)a + le16_to_cpu(
861 a->data.resident.value_offset),848 a->data.resident.value_offset),
@@ -954,10 +941,6 @@ view_index_meta: · 92 unmodified lines
954 ir = (struct index_root *)((u8 *)a +941 ir = (struct index_root *)((u8 *)a +
955 le16_to_cpu(a->data.resident.value_offset));942 le16_to_cpu(a->data.resident.value_offset));
956 ir_end = (u8 *)ir + le32_to_cpu(a->data.resident.value_length);943 ir_end = (u8 *)ir + le32_to_cpu(a->data.resident.value_length);
957 if (ir_end > (u8 *)ctx->mrec + vol->mft_record_size) {
958 ntfs_error(vi->i_sb, "$INDEX_ROOT attribute is corrupt.");
959 goto unm_err_out;
960 }
961 index_end = (u8 *)&ir->index +944 index_end = (u8 *)&ir->index +
962 le32_to_cpu(ir->index.index_length);945 le32_to_cpu(ir->index.index_length);
963 if (index_end > ir_end) {946 if (index_end > ir_end) {
@@ -1552,10 +1535,6 @@ static int ntfs_read_locked_index_inode(struct inode *base_vi, struct inode *vi) · 588 unmodified lines
1552 1535
1553 ir = (struct index_root *)((u8 *)a + le16_to_cpu(a->data.resident.value_offset));1536 ir = (struct index_root *)((u8 *)a + le16_to_cpu(a->data.resident.value_offset));
1554 ir_end = (u8 *)ir + le32_to_cpu(a->data.resident.value_length);1537 ir_end = (u8 *)ir + le32_to_cpu(a->data.resident.value_length);
1555 if (ir_end > (u8 *)ctx->mrec + vol->mft_record_size) {
1556 ntfs_error(vi->i_sb, "$INDEX_ROOT attribute is corrupt.");
1557 goto unm_err_out;
1558 }
1559 index_end = (u8 *)&ir->index + le32_to_cpu(ir->index.index_length);1538 index_end = (u8 *)&ir->index + le32_to_cpu(ir->index.index_length);
1560 if (index_end > ir_end) {1539 if (index_end > ir_end) {
1561 ntfs_error(vi->i_sb, "Index is corrupt.");1540 ntfs_error(vi->i_sb, "Index is corrupt.");
@@ -1999,13 +1978,6 @@ int ntfs_read_inode_mount(struct inode *vi) · 437 unmodified lines
1999 goto put_err_out;1978 goto put_err_out;
2000 }1979 }
2001 } else /* if (!ctx.attr->non_resident) */ {1980 } else /* if (!ctx.attr->non_resident) */ {
2002 if ((u8 *)a + le16_to_cpu(
2003 a->data.resident.value_offset) +
2004 le32_to_cpu(a->data.resident.value_length) >
2005 (u8 *)ctx->mrec + vol->mft_record_size) {
2006 ntfs_error(sb, "Corrupt attribute list attribute.");
2007 goto put_err_out;
2008 }
2009 /* Now copy the attribute list. */1981 /* Now copy the attribute list. */
2010 memcpy(ni->attr_list, (u8 *)a + le16_to_cpu(1982 memcpy(ni->attr_list, (u8 *)a + le16_to_cpu(
2011 a->data.resident.value_offset),1983 a->data.resident.value_offset),
fs/ntfs/namei.c+0−8
@@ -274,7 +274,6 @@ handle_name: · 273 unmodified lines
274 }274 }
275 do {275 do {
276 struct attr_record *a;276 struct attr_record *a;
277 u32 val_len;
278 277
279 err = ntfs_attr_lookup(AT_FILE_NAME, NULL, 0, 0, 0,278 err = ntfs_attr_lookup(AT_FILE_NAME, NULL, 0, 0, 0,
280 NULL, 0, ctx);279 NULL, 0, ctx);
@@ -289,15 +288,8 @@ handle_name: · 8 unmodified lines
289 a = ctx->attr;288 a = ctx->attr;
290 if (a->non_resident || a->flags)289 if (a->non_resident || a->flags)
291 goto eio_err_out;290 goto eio_err_out;
292 val_len = le32_to_cpu(a->data.resident.value_length);
293 if (le16_to_cpu(a->data.resident.value_offset) +
294 val_len > le32_to_cpu(a->length))
295 goto eio_err_out;
296 fn = (struct file_name_attr *)((u8 *)ctx->attr + le16_to_cpu(291 fn = (struct file_name_attr *)((u8 *)ctx->attr + le16_to_cpu(
297 ctx->attr->data.resident.value_offset));292 ctx->attr->data.resident.value_offset));
298 if ((u32)(fn->file_name_length * sizeof(__le16) +
299 sizeof(struct file_name_attr)) > val_len)
300 goto eio_err_out;
301 } while (fn->file_name_type != FILE_NAME_WIN32);293 } while (fn->file_name_type != FILE_NAME_WIN32);
302 294
303 /* Convert the found WIN32 name to current NLS code page. */295 /* Convert the found WIN32 name to current NLS code page. */
fs/ntfs/super.c+0−6
@@ -1512,7 +1512,6 @@ iput_volume_failed: · 1511 unmodified lines
1512 1512
1513 if (ntfs_attr_lookup(AT_VOLUME_INFORMATION, NULL, 0, 0, 0, NULL, 0,1513 if (ntfs_attr_lookup(AT_VOLUME_INFORMATION, NULL, 0, 0, 0, NULL, 0,
1514 ctx) || ctx->attr->non_resident || ctx->attr->flags) {1514 ctx) || ctx->attr->non_resident || ctx->attr->flags) {
1515err_put_vol:
1516 ntfs_attr_put_search_ctx(ctx);1515 ntfs_attr_put_search_ctx(ctx);
1517get_ctx_vol_failed:1516get_ctx_vol_failed:
1518 unmap_mft_record(NTFS_I(vol->vol_ino));1517 unmap_mft_record(NTFS_I(vol->vol_ino));
@@ -1520,11 +1519,6 @@ get_ctx_vol_failed: · 1 unmodified line
1520 }1519 }
1521 vi = (struct volume_information *)((char *)ctx->attr +1520 vi = (struct volume_information *)((char *)ctx->attr +
1522 le16_to_cpu(ctx->attr->data.resident.value_offset));1521 le16_to_cpu(ctx->attr->data.resident.value_offset));
1523 /* Some bounds checks. */
1524 if ((u8 *)vi < (u8 *)ctx->attr || (u8 *)vi +
1525 le32_to_cpu(ctx->attr->data.resident.value_length) >
1526 (u8 *)ctx->attr + le32_to_cpu(ctx->attr->length))
1527 goto err_put_vol;
1528 /* Copy the volume flags and version to the struct ntfs_volume structure. */1522 /* Copy the volume flags and version to the struct ntfs_volume structure. */
1529 vol->vol_flags = vi->flags;1523 vol->vol_flags = vi->flags;
1530 vol->major_ver = vi->major_ver;1524 vol->major_ver = vi->major_ver;