2023-12-06 15:12:46

by Konstantin Komarov

Subject: [PATCH 08/16] fs/ntfs3: Fix detected field-spanning write (size 8) of single field "le->name"

Signed-off-by: Konstantin Komarov <[email protected]>
---
 fs/ntfs3/ntfs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h
index 86aecbb01a92..13e96fc63dae 100644
--- a/fs/ntfs3/ntfs.h
+++ b/fs/ntfs3/ntfs.h
@@ -523,7 +523,7 @@ struct ATTR_LIST_ENTRY {
     __le64 vcn;        // 0x08: Starting VCN of this attribute.
     struct MFT_REF ref;    // 0x10: MFT record number with attribute.
     __le16 id;        // 0x18: struct ATTRIB ID.
-    __le16 name[3];        // 0x1A: Just to align. To get real name can
use bNameOffset.
+    __le16 name[];        // 0x1A: Just to align. To get real name can
use name_off.

 }; // sizeof(0x20)

--
2.34.1

2023-12-07 09:38:31

by Geert Uytterhoeven

Subject: Re: [PATCH 08/16] fs/ntfs3: Fix detected field-spanning write (size 8) of single field "le->name"

Hi Konstantin,

On Wed, Dec 6, 2023 at 4:12 PM Konstantin Komarovc
<[email protected]> wrote:
> Signed-off-by: Konstantin Komarov <[email protected]>

Thanks for your patch, which is now commit d155617006ebc172 ("fs/ntfs3:
Fix detected field-spanning write (size 8) of single field "le->name"")
in next-20231207.

> --- a/fs/ntfs3/ntfs.h
> +++ b/fs/ntfs3/ntfs.h
> @@ -523,7 +523,7 @@ struct ATTR_LIST_ENTRY {
> __le64 vcn; // 0x08: Starting VCN of this attribute.
> struct MFT_REF ref; // 0x10: MFT record number with attribute.
> __le16 id; // 0x18: struct ATTRIB ID.
> - __le16 name[3]; // 0x1A: Just to align. To get real name can
> use bNameOffset.
> + __le16 name[]; // 0x1A: Just to align. To get real name can
> use name_off.

[email protected] reports for all m68k configs[1]:

include/linux/build_bug.h:78:41: error: static assertion failed:
"sizeof(struct ATTR_LIST_ENTRY) == 0x20"

>
> }; // sizeof(0x20)

Indeed, we now have a hole of 4 bytes at the end of the structure,
which shrinks the size of the structure on all architectures where
alignof(u64) < sizeof(u64).

So either the patch should be reverted, or explicit padding should
be added. Your patch description is not very descriptive, so I
don't know which is the correct solution.

[1] http://kisskb.ellerman.id.au/kisskb/head/8e00ce02066e8f6f1ad5eab49a2ede7bf7a5ef64

Gr{oetje,eeting}s,

Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds