[SRU][J][PATCH 1/2] ntfs3: Add bounds checking to mi_enum_attr()

[Massimiliano Pellizzer]

From: lei lu <llfamsec at gmail.com>

Added bounds checking to make sure that every attr don't stray beyond
valid memory region.

Signed-off-by: lei lu <llfamsec at gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich at paragon-software.com>
(backported from commit 556bdf27c2dd5c74a9caacbe524b943a6cd42d99)
[mpellizzer: backported considering differences in context due to a
missing commit 013ff63b649475, which adds more attributes checks but
does not affect the patch]
CVE-2024-50248
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer at canonical.com>
---
 fs/ntfs3/record.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 383fc3437f02..05d5fb58c9db 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -215,23 +215,18 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 
 		attr = Add2Ptr(rec, off);
 	} else {
-		/* Check if input attr inside record. */
+		/*
+		 * We don't need to check previous attr here. There is
+		 * a bounds checking in the previous round.
+		 */
 		off = PtrOffset(rec, attr);
-		if (off >= used)
-			return NULL;
 
 		asize = le32_to_cpu(attr->size);
-		if (asize < SIZEOF_RESIDENT) {
-			/* Impossible 'cause we should not return such attribute. */
-			return NULL;
-		}
 
 		attr = Add2Ptr(attr, asize);
 		off += asize;
 	}
 
-	asize = le32_to_cpu(attr->size);
-
 	/* Can we use the first field (attr->type). */
 	if (off + 8 > used) {
 		static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8);
@@ -248,6 +243,12 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
 	if ((t32 & 0xf) || (t32 > 0x100))
 		return NULL;
 
+	asize = le32_to_cpu(attr->size);
+	if (asize < SIZEOF_RESIDENT) {
+		/* Impossible 'cause we should not return such attribute. */
+		return NULL;
+	}
+
 	/* Check overflow and boundary. */
 	if (off + asize < off || off + asize > used)
 		return NULL;
-- 
2.43.0