This is a note to let you know that I've just added the patch titled
fs/ntfs3: Validate attribute data and valid sizes
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fs-ntfs3-validate-attribute-data-and-valid-sizes.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 019d22eb0eb707fc099e6e8fad9b3933236a06d0 Mon Sep 17 00:00:00 2001
From: Abdun Nihaal <abdun.nihaal@xxxxxxxxx>
Date: Tue, 4 Oct 2022 08:45:02 +0530
Subject: fs/ntfs3: Validate attribute data and valid sizes
From: Abdun Nihaal <abdun.nihaal@xxxxxxxxx>
commit 019d22eb0eb707fc099e6e8fad9b3933236a06d0 upstream.
The data_size and valid_size fields of non resident attributes should be
less than the its alloc_size field, but this is not checked in
ntfs_read_mft function.
Syzbot reports a allocation order warning due to a large unchecked value
of data_size getting assigned to inode->i_size which is then passed to
kcalloc.
Add sanity check for ensuring that the data_size and valid_size fields
are not larger than alloc_size field.
Link: https://syzkaller.appspot.com/bug?extid=fa4648a5446460b7b963
Reported-and-tested-by: syzbot+fa4648a5446460b7b963@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: (82cae269cfa95) fs/ntfs3: Add initialization of super block
Signed-off-by: Abdun Nihaal <abdun.nihaal@xxxxxxxxx>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/ntfs3/inode.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -132,6 +132,13 @@ next_attr:
if (le16_to_cpu(attr->name_off) + attr->name_len > asize)
goto out;
+ if (attr->non_res) {
+ t64 = le64_to_cpu(attr->nres.alloc_size);
+ if (le64_to_cpu(attr->nres.data_size) > t64 ||
+ le64_to_cpu(attr->nres.valid_size) > t64)
+ goto out;
+ }
+
switch (attr->type) {
case ATTR_STD:
if (attr->non_res ||
Patches currently in stable-queue which might be from abdun.nihaal@xxxxxxxxx are
queue-5.15/fs-ntfs3-validate-attribute-data-and-valid-sizes.patch
