Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <96b69941-36c3-04a1-cbfb-5a82c11e39f6@paragon-software.com>
Date:   Fri, 30 Dec 2022 15:23:59 +0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.6.0
Subject: [PATCH 1/5] fs/ntfs3: Add null pointer checks
Content-Language: en-US
From:   Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
To:     <ntfs3@lists.linux.dev>
CC:     <linux-kernel@vger.kernel.org>, <linux-fsdevel@vger.kernel.org>
References: <b06828df-f9b9-1c5d-d6db-05839bad7016@paragon-software.com>
In-Reply-To: <b06828df-f9b9-1c5d-d6db-05839bad7016@paragon-software.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

Added null pointer checks in function ntfs_security_init.
Also added le32_to_cpu in functions ntfs_security_init and indx_read.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
---
  fs/ntfs3/fsntfs.c | 16 ++++++++++------
  fs/ntfs3/index.c  |  3 ++-
  2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
index 8de861ddec60..1f36e89dcff7 100644
--- a/fs/ntfs3/fsntfs.c
+++ b/fs/ntfs3/fsntfs.c
@@ -1876,10 +1876,12 @@ int ntfs_security_init(struct ntfs_sb_info *sbi)
          goto out;
      }

-    root_sdh = resident_data_ex(attr, sizeof(struct INDEX_ROOT));
-    if (root_sdh->type != ATTR_ZERO ||
+    if(!(root_sdh = resident_data_ex(attr, sizeof(struct INDEX_ROOT))) ||
+        root_sdh->type != ATTR_ZERO ||
          root_sdh->rule != NTFS_COLLATION_TYPE_SECURITY_HASH ||
-        offsetof(struct INDEX_ROOT, ihdr) + root_sdh->ihdr.used > 
attr->res.data_size) {
+        offsetof(struct INDEX_ROOT, ihdr) +
+            le32_to_cpu(root_sdh->ihdr.used) >
+            le32_to_cpu(attr->res.data_size)) {
          err = -EINVAL;
          goto out;
      }
@@ -1895,10 +1897,12 @@ int ntfs_security_init(struct ntfs_sb_info *sbi)
          goto out;
      }

-    root_sii = resident_data_ex(attr, sizeof(struct INDEX_ROOT));
-    if (root_sii->type != ATTR_ZERO ||
+    if(!(root_sii = resident_data_ex(attr, sizeof(struct INDEX_ROOT))) ||
+        root_sii->type != ATTR_ZERO ||
          root_sii->rule != NTFS_COLLATION_TYPE_UINT ||
-        offsetof(struct INDEX_ROOT, ihdr) + root_sii->ihdr.used > 
attr->res.data_size) {
+        offsetof(struct INDEX_ROOT, ihdr) +
+            le32_to_cpu(root_sii->ihdr.used) >
+            le32_to_cpu(attr->res.data_size)) {
          err = -EINVAL;
          goto out;
      }
diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index f716487ec8a0..8718df791a55 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -1102,7 +1102,8 @@ int indx_read(struct ntfs_index *indx, struct 
ntfs_inode *ni, CLST vbn,
      }

      /* check for index header length */
-    if (offsetof(struct INDEX_BUFFER, ihdr) + ib->ihdr.used > bytes) {
+    if (offsetof(struct INDEX_BUFFER, ihdr) + le32_to_cpu(ib->ihdr.used) >
+        bytes) {
          err = -EINVAL;
          goto out;
      }
-- 
2.34.1