Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <4628ae8a-39e9-ecf8-3efe-193a1ad14d23@paragon-software.com>
Date:   Fri, 30 Dec 2022 15:25:48 +0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.6.0
Subject: [PATCH 3/5] fs/ntfs3: Check for extremely large size of $AttrDef
Content-Language: en-US
From:   Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
To:     <ntfs3@lists.linux.dev>
CC:     <linux-kernel@vger.kernel.org>, <linux-fsdevel@vger.kernel.org>
References: <b06828df-f9b9-1c5d-d6db-05839bad7016@paragon-software.com>
In-Reply-To: <b06828df-f9b9-1c5d-d6db-05839bad7016@paragon-software.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

Added additional checking for size of $AttrDef.
Added comment.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
---
  fs/ntfs3/super.c | 10 +++++++++-
  1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
index ef4ea3f21905..0967035146ce 100644
--- a/fs/ntfs3/super.c
+++ b/fs/ntfs3/super.c
@@ -1185,10 +1185,18 @@ static int ntfs_fill_super(struct super_block 
*sb, struct fs_context *fc)
          goto out;
      }

-    if (inode->i_size < sizeof(struct ATTR_DEF_ENTRY)) {
+    /*
+     * Typical $AttrDef contains up to 20 entries.
+     * Check for extremely large size.
+     */
+    if (inode->i_size < sizeof(struct ATTR_DEF_ENTRY) ||
+        inode->i_size > 100 * sizeof(struct ATTR_DEF_ENTRY)) {
+        ntfs_err(sb, "Looks like $AttrDef is corrupted (size=%llu).",
+             inode->i_size);
          err = -EINVAL;
          goto put_inode_out;
      }
+
      bytes = inode->i_size;
      sbi->def_table = t = kmalloc(bytes, GFP_NOFS | __GFP_NOWARN);
      if (!t) {
-- 
2.34.1