ntfs: validate index block header more strictly

Modify ntfs_index_block_inconsisent() to perform stricter validation of
INDEX_HEADER geometry in INDX blocks, and update
ntfs_lookup_inode_by_name() to use that function to validate INDX
blocks.

Cc: stable@vger.kernel.org # v7.1
Tested-by: woot000 <woot000@woot000.com>
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
index 20f5c7074bdd12a3768d204eec0410638057df7c..6745a0e6e3e76d51726f5baaeffda819a0750bbe 100644 (file)
--- a/fs/ntfs/dir.c
+++ b/fs/ntfs/dir.c
@@ -342,43 +342,19 @@ fast_descend_into_child_node:
                        dir_ni->mft_no);
                goto unm_err_out;
        }
-       /* Catch multi sector transfer fixup errors. */
-       if (unlikely(!ntfs_is_indx_record(ia->magic))) {
-               ntfs_error(sb,
-                       "Directory index record with vcn 0x%llx is corrupt.  Corrupt inode 0x%llx.  Run chkdsk.",
-                       vcn, dir_ni->mft_no);
-               goto unm_err_out;
-       }
-       if (le64_to_cpu(ia->index_block_vcn) != vcn) {
-               ntfs_error(sb,
-                       "Actual VCN (0x%llx) of index buffer is different from expected VCN (0x%llx). Directory inode 0x%llx is corrupt or driver bug.",
-                       le64_to_cpu(ia->index_block_vcn),
-                       vcn, dir_ni->mft_no);
-               goto unm_err_out;
-       }
-       if (le32_to_cpu(ia->index.allocated_size) + 0x18 !=
-                       dir_ni->itype.index.block_size) {
-               ntfs_error(sb,
-                       "Index buffer (VCN 0x%llx) of directory inode 0x%llx has a size (%u) differing from the directory specified size (%u). Directory inode is corrupt or driver bug.",
-                       vcn, dir_ni->mft_no,
-                       le32_to_cpu(ia->index.allocated_size) + 0x18,
-                       dir_ni->itype.index.block_size);
-               goto unm_err_out;
-       }
        index_end = (u8 *)ia + dir_ni->itype.index.block_size;
        if (index_end > kaddr + PAGE_SIZE) {
                ntfs_error(sb,
-                       "Index buffer (VCN 0x%llx) of directory inode 0x%llx crosses page boundary. Impossible! Cannot access! This is probably a bug in the driver.",
-                       vcn, dir_ni->mft_no);
+                          "Index buffer (VCN 0x%llx) of directory inode 0x%llx crosses page boundary. Impossible! Cannot access! This is probably a bug in the driver.",
+                          vcn, dir_ni->mft_no);
                goto unm_err_out;
        }
-       index_end = (u8 *)&ia->index + le32_to_cpu(ia->index.index_length);
-       if (index_end > (u8 *)ia + dir_ni->itype.index.block_size) {
-               ntfs_error(sb,
-                       "Size of index buffer (VCN 0x%llx) of directory inode 0x%llx exceeds maximum size.",
-                       vcn, dir_ni->mft_no);
+       err = ntfs_index_block_inconsistent(vol, ia,
+                                           dir_ni->itype.index.block_size,
+                                           vcn, dir_ni->mft_no);
+       if (err)
                goto unm_err_out;
-       }
+       index_end = (u8 *)&ia->index + le32_to_cpu(ia->index.index_length);
        /* The first index entry. */
        ie = (struct index_entry *)((u8 *)&ia->index +
                        le32_to_cpu(ia->index.entries_offset));

diff --git a/fs/ntfs/index.c b/fs/ntfs/index.c
index 146e011c1a418260592c395425f1b0fc6bc67d94..9713b082b03df3c5b4a20ba2ff9421cbc379a740 100644 (file)
--- a/fs/ntfs/index.c
+++ b/fs/ntfs/index.c
@@ -303,6 +303,55 @@ static int ntfs_ie_end(struct index_entry *ie)
        return ie->flags & INDEX_ENTRY_END || !ie->length;
 }
 
+static int ntfs_index_header_inconsistent(struct ntfs_volume *vol,
+                                         const struct index_header *ih,
+                                         u32 bytes_available, u64 inum)
+{
+       u32 entries_offset, index_length, allocated_size;
+
+       if (bytes_available < sizeof(struct index_header)) {
+               ntfs_error(vol->sb,
+                          "index block in inode %llu is smaller than an index header.",
+                          (unsigned long long)inum);
+               return -EIO;
+       }
+
+       entries_offset = le32_to_cpu(ih->entries_offset);
+       index_length = le32_to_cpu(ih->index_length);
+       allocated_size = le32_to_cpu(ih->allocated_size);
+
+       if (entries_offset < sizeof(struct index_header) ||
+           entries_offset > bytes_available) {
+               ntfs_error(vol->sb,
+                          "Invalid index entry offset in inode %llu.",
+                          (unsigned long long)inum);
+               return -EIO;
+       }
+
+       if (index_length <= entries_offset) {
+               ntfs_error(vol->sb,
+                          "No space for index entries in inode %llu.",
+                          (unsigned long long)inum);
+               return -EIO;
+       }
+
+       if (allocated_size < index_length) {
+               ntfs_error(vol->sb,
+                          "Index entries overflow in inode %llu.",
+                          (unsigned long long)inum);
+               return -EIO;
+       }
+
+       if (allocated_size > bytes_available || index_length > bytes_available) {
+               ntfs_error(vol->sb,
+                          "Index entries in inode %llu exceed the available buffer.",
+                          (unsigned long long)inum);
+               return -EIO;
+       }
+
+       return 0;
+}
+
 /*
  *  Find the last entry in the index block
  */
@@ -437,7 +486,7 @@ static struct index_entry *ntfs_ie_dup_novcn(struct index_entry *ie)
  * The size of block is assumed to have been checked to be what is
  * defined in the index root.
  *
- * Returns 0 if no error was found -1 otherwise (with errno unchanged)
+ * Returns 0 if no error was found, -EIO otherwise
  *
  * |<--->|  offsetof(struct index_block, index)
  * |     |<--->|  sizeof(struct index_header)
@@ -452,21 +501,20 @@ static struct index_entry *ntfs_ie_dup_novcn(struct index_entry *ie)
  *
  * size(struct index_header) <= ent_offset < ind_length <= alloc_size < bk_size
  */
-static int ntfs_index_block_inconsistent(struct ntfs_index_context *icx,
-               struct index_block *ib, s64 vcn)
+int ntfs_index_block_inconsistent(struct ntfs_volume *vol,
+                                 const struct index_block *ib,
+                                 u32 block_size, s64 vcn, u64 inum)
 {
        u32 ib_size = (unsigned int)le32_to_cpu(ib->index.allocated_size) +
                offsetof(struct index_block, index);
-       struct super_block *sb = icx->idx_ni->vol->sb;
-       unsigned long long inum = icx->idx_ni->mft_no;
+       struct super_block *sb = vol->sb;
 
        ntfs_debug("Entering\n");
 
        if (!ntfs_is_indx_record(ib->magic)) {
-
                ntfs_error(sb, "Corrupt index block signature: vcn %lld inode %llu\n",
-                               vcn, (unsigned long long)icx->idx_ni->mft_no);
-               return -1;
+                          vcn, (unsigned long long)inum);
+               return -EIO;
        }
 
        if (le64_to_cpu(ib->index_block_vcn) != vcn) {
@@ -474,30 +522,21 @@ static int ntfs_index_block_inconsistent(struct ntfs_index_context *icx,
                        "Corrupt index block: s64 (%lld) is different from expected s64 (%lld) in inode %llu\n",
                        (long long)le64_to_cpu(ib->index_block_vcn),
                        vcn, inum);
-               return -1;
+               return -EIO;
        }
 
-       if (ib_size != icx->block_size) {
+       if (ib_size != block_size) {
                ntfs_error(sb,
-                       "Corrupt index block : s64 (%lld) of inode %llu has a size (%u) differing from the index specified size (%u)\n",
-                       vcn, inum, ib_size, icx->block_size);
-               return -1;
+                          "Corrupt index block : s64 (%lld) of inode %llu has a size (%u) differing from the index specified size (%u)\n",
+                          vcn, inum, ib_size, block_size);
+               return -EIO;
        }
 
-       if (le32_to_cpu(ib->index.entries_offset) < sizeof(struct index_header)) {
-               ntfs_error(sb, "Invalid index entry offset in inode %lld\n", inum);
-               return -1;
-       }
-       if (le32_to_cpu(ib->index.index_length) <=
-           le32_to_cpu(ib->index.entries_offset)) {
-               ntfs_error(sb, "No space for index entries in inode %lld\n", inum);
-               return -1;
-       }
-       if (le32_to_cpu(ib->index.allocated_size) <
-           le32_to_cpu(ib->index.index_length)) {
-               ntfs_error(sb, "Index entries overflow in inode %lld\n", inum);
-               return -1;
-       }
+       if (ntfs_index_header_inconsistent(vol, &ib->index,
+                                          block_size -
+                                          offsetof(struct index_block, index),
+                                          inum))
+               return -EIO;
 
        return 0;
 }
@@ -665,12 +704,14 @@ static int ntfs_ib_read(struct ntfs_index_context *icx, s64 vcn, struct index_bl
                else
                        ntfs_error(icx->idx_ni->vol->sb,
                                "Failed to read full index block at %lld\n", pos);
-               return -1;
+               return -EIO;
        }
 
        post_read_mst_fixup((struct ntfs_record *)((u8 *)dst), icx->block_size);
-       if (ntfs_index_block_inconsistent(icx, dst, vcn))
-               return -1;
+       if (ntfs_index_block_inconsistent(icx->idx_ni->vol, dst,
+                                         icx->block_size, vcn,
+                                         icx->idx_ni->mft_no))
+               return -EIO;
 
        return 0;
 }

diff --git a/fs/ntfs/index.h b/fs/ntfs/index.h
index e68d6fabaf9f16c7cfec2a5cce0c72c07b2d5702..3451ec8a1c4eb794d2d568a0ee84050b54adbf43 100644 (file)
--- a/fs/ntfs/index.h
+++ b/fs/ntfs/index.h
@@ -89,6 +89,9 @@ struct ntfs_index_context {
        bool sync_write;
 };
 
+int ntfs_index_block_inconsistent(struct ntfs_volume *vol,
+                                 const struct index_block *ib,
+                                 u32 block_size, s64 vcn, u64 inum);
 int ntfs_index_entry_inconsistent(struct ntfs_index_context *icx, struct ntfs_volume *vol,
                const struct index_entry *ie, __le32 collation_rule, u64 inum);
 struct ntfs_index_context *ntfs_index_ctx_get(struct ntfs_inode *ni, __le16 *name,