github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ntfs: validate index block header more strictly

Browse Source 
Modify ntfs_index_block_inconsisent() to perform stricter validation of
INDEX_HEADER geometry in INDX blocks, and update
ntfs_lookup_inode_by_name() to use that function to validate INDX
blocks.

Cc: stable@vger.kernel.org # v7.1
Tested-by: woot000 <woot000@woot000.com>
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
This commit is contained in:
Hyunchul Lee 2026-05-23 13:14:20 +09:00 committed by Namjae Jeon
parent c05132077d
commit 14bc34fe94
3 changed files with 81 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
fs/ntfs/dir.c
View File

@ -342,43 +342,19 @@ u64 ntfs_lookup_inode_by_name(struct ntfs_inode *dir_ni, const __le16 *uname,
dir_ni->mft_no);
goto unm_err_out;
}
/* Catch multi sector transfer fixup errors. */
if (unlikely(!ntfs_is_indx_record(ia->magic))) {
ntfs_error(sb,
"Directory index record with vcn 0x%llx is corrupt. Corrupt inode 0x%llx. Run chkdsk.",
vcn, dir_ni->mft_no);
goto unm_err_out;
}
if (le64_to_cpu(ia->index_block_vcn) != vcn) {
ntfs_error(sb,
"Actual VCN (0x%llx) of index buffer is different from expected VCN (0x%llx). Directory inode 0x%llx is corrupt or driver bug.",
le64_to_cpu(ia->index_block_vcn),
vcn, dir_ni->mft_no);
goto unm_err_out;
}
if (le32_to_cpu(ia->index.allocated_size) + 0x18 !=
dir_ni->itype.index.block_size) {
ntfs_error(sb,
"Index buffer (VCN 0x%llx) of directory inode 0x%llx has a size (%u) differing from the directory specified size (%u). Directory inode is corrupt or driver bug.",
vcn, dir_ni->mft_no,
le32_to_cpu(ia->index.allocated_size) + 0x18,
dir_ni->itype.index.block_size);
goto unm_err_out;
}
index_end = (u8 *)ia + dir_ni->itype.index.block_size;
if (index_end > kaddr + PAGE_SIZE) {
ntfs_error(sb,
"Index buffer (VCN 0x%llx) of directory inode 0x%llx crosses page boundary. Impossible! Cannot access! This is probably a bug in the driver.",
vcn, dir_ni->mft_no);
"Index buffer (VCN 0x%llx) of directory inode 0x%llx crosses page boundary. Impossible! Cannot access! This is probably a bug in the driver.",
vcn, dir_ni->mft_no);
goto unm_err_out;
}
err = ntfs_index_block_inconsistent(vol, ia,
dir_ni->itype.index.block_size,
vcn, dir_ni->mft_no);
if (err)
goto unm_err_out;
index_end = (u8 *)&ia->index + le32_to_cpu(ia->index.index_length);
if (index_end > (u8 *)ia + dir_ni->itype.index.block_size) {
ntfs_error(sb,
"Size of index buffer (VCN 0x%llx) of directory inode 0x%llx exceeds maximum size.",
vcn, dir_ni->mft_no);
goto unm_err_out;
}
/* The first index entry. */
ie = (struct index_entry *)((u8 *)&ia->index +
le32_to_cpu(ia->index.entries_offset));

101
fs/ntfs/index.c
View File

@ -303,6 +303,55 @@ static int ntfs_ie_end(struct index_entry *ie)
return ie->flags & INDEX_ENTRY_END || !ie->length;
}
static int ntfs_index_header_inconsistent(struct ntfs_volume *vol,
const struct index_header *ih,
u32 bytes_available, u64 inum)
{
u32 entries_offset, index_length, allocated_size;
if (bytes_available < sizeof(struct index_header)) {
ntfs_error(vol->sb,
"index block in inode %llu is smaller than an index header.",
(unsigned long long)inum);
return -EIO;
}
entries_offset = le32_to_cpu(ih->entries_offset);
index_length = le32_to_cpu(ih->index_length);
allocated_size = le32_to_cpu(ih->allocated_size);
if (entries_offset < sizeof(struct index_header) ||
entries_offset > bytes_available) {
ntfs_error(vol->sb,
"Invalid index entry offset in inode %llu.",
(unsigned long long)inum);
return -EIO;
}
if (index_length <= entries_offset) {
ntfs_error(vol->sb,
"No space for index entries in inode %llu.",
(unsigned long long)inum);
return -EIO;
}
if (allocated_size < index_length) {
ntfs_error(vol->sb,
"Index entries overflow in inode %llu.",
(unsigned long long)inum);
return -EIO;
}
if (allocated_size > bytes_available || index_length > bytes_available) {
ntfs_error(vol->sb,
"Index entries in inode %llu exceed the available buffer.",
(unsigned long long)inum);
return -EIO;
}
return 0;
}
/*
* Find the last entry in the index block
*/
@ -437,7 +486,7 @@ static struct index_entry *ntfs_ie_dup_novcn(struct index_entry *ie)
* The size of block is assumed to have been checked to be what is
* defined in the index root.
*
* Returns 0 if no error was found -1 otherwise (with errno unchanged)
* Returns 0 if no error was found, -EIO otherwise
*
* |<--->| offsetof(struct index_block, index)
* | |<--->| sizeof(struct index_header)
@ -452,21 +501,20 @@ static struct index_entry *ntfs_ie_dup_novcn(struct index_entry *ie)
*
* size(struct index_header) <= ent_offset < ind_length <= alloc_size < bk_size
*/
static int ntfs_index_block_inconsistent(struct ntfs_index_context *icx,
struct index_block *ib, s64 vcn)
int ntfs_index_block_inconsistent(struct ntfs_volume *vol,
const struct index_block *ib,
u32 block_size, s64 vcn, u64 inum)
{
u32 ib_size = (unsigned int)le32_to_cpu(ib->index.allocated_size) +
offsetof(struct index_block, index);
struct super_block *sb = icx->idx_ni->vol->sb;
unsigned long long inum = icx->idx_ni->mft_no;
struct super_block *sb = vol->sb;
ntfs_debug("Entering\n");
if (!ntfs_is_indx_record(ib->magic)) {
ntfs_error(sb, "Corrupt index block signature: vcn %lld inode %llu\n",
vcn, (unsigned long long)icx->idx_ni->mft_no);
return -1;
vcn, (unsigned long long)inum);
return -EIO;
}
if (le64_to_cpu(ib->index_block_vcn) != vcn) {
@ -474,30 +522,21 @@ static int ntfs_index_block_inconsistent(struct ntfs_index_context *icx,
"Corrupt index block: s64 (%lld) is different from expected s64 (%lld) in inode %llu\n",
(long long)le64_to_cpu(ib->index_block_vcn),
vcn, inum);
return -1;
return -EIO;
}
if (ib_size != icx->block_size) {
if (ib_size != block_size) {
ntfs_error(sb,
"Corrupt index block : s64 (%lld) of inode %llu has a size (%u) differing from the index specified size (%u)\n",
vcn, inum, ib_size, icx->block_size);
return -1;
"Corrupt index block : s64 (%lld) of inode %llu has a size (%u) differing from the index specified size (%u)\n",
vcn, inum, ib_size, block_size);
return -EIO;
}
if (le32_to_cpu(ib->index.entries_offset) < sizeof(struct index_header)) {
ntfs_error(sb, "Invalid index entry offset in inode %lld\n", inum);
return -1;
}
if (le32_to_cpu(ib->index.index_length) <=
le32_to_cpu(ib->index.entries_offset)) {
ntfs_error(sb, "No space for index entries in inode %lld\n", inum);
return -1;
}
if (le32_to_cpu(ib->index.allocated_size) <
le32_to_cpu(ib->index.index_length)) {
ntfs_error(sb, "Index entries overflow in inode %lld\n", inum);
return -1;
}
if (ntfs_index_header_inconsistent(vol, &ib->index,
block_size -
offsetof(struct index_block, index),
inum))
return -EIO;
return 0;
}
@ -665,12 +704,14 @@ static int ntfs_ib_read(struct ntfs_index_context *icx, s64 vcn, struct index_bl
else
ntfs_error(icx->idx_ni->vol->sb,
"Failed to read full index block at %lld\n", pos);
return -1;
return -EIO;
}
post_read_mst_fixup((struct ntfs_record *)((u8 *)dst), icx->block_size);
if (ntfs_index_block_inconsistent(icx, dst, vcn))
return -1;
if (ntfs_index_block_inconsistent(icx->idx_ni->vol, dst,
icx->block_size, vcn,
icx->idx_ni->mft_no))
return -EIO;
return 0;
}

3
fs/ntfs/index.h
View File

@ -89,6 +89,9 @@ struct ntfs_index_context {
bool sync_write;
};
int ntfs_index_block_inconsistent(struct ntfs_volume *vol,
const struct index_block *ib,
u32 block_size, s64 vcn, u64 inum);
int ntfs_index_entry_inconsistent(struct ntfs_index_context *icx, struct ntfs_volume *vol,
const struct index_entry *ie, __le32 collation_rule, u64 inum);
struct ntfs_index_context *ntfs_index_ctx_get(struct ntfs_inode *ni, __le16 *name,