[PATCH] fs/ntfs3: fix out-of-bounds read in ni_query_ads()

[PATCH] fs/ntfs3: fix out-of-bounds read in ni_query_ads()

[Zhan Xusheng]

ni_query_ads() copies the base inode's named $DATA attribute names,
newline separated, into the caller's iterator:

	if (vbo + err > *pos) {
		size_t off = *pos - vbo;

		used = err - off;
		done = copy_to_iter(Add2Ptr(buf, off), min(used, bytes), iter);
	}
	...
	*pos += done;
	if (done >= bytes)
		break;
	bytes -= done;
	vbo += err;

The guard establishes *pos < vbo + err but not *pos >= vbo, and off is a
size_t.  copy_to_iter() returns the number of bytes it managed to copy,
which is zero when the destination cannot be written.  *pos then stays
put while vbo advances by the full entry length, so the next iteration
runs with *pos < vbo.

For two streams whose names are 40 and 30 bytes, the second iteration
gets off = (size_t)-41 and used = 72.  min(used, bytes) keeps 72 and
Add2Ptr(buf, off) resolves to buf - 41, so copy_to_iter() reads 72 bytes
starting 41 bytes before the kmalloc(PAGE_SIZE) buffer and copies them
to userspace.

ntfs_init_ads_node() accepts the query_streams name on any regular file
(fs/ntfs3/inode.c:540) and ntfs_init_fs_context() leaves ads enabled, so
a read of file:query_streams into an unwritable buffer reaches this on a
volume with two streams on one file.

Stop the walk once *pos has fallen behind the current entry.

Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Fixes: be310476e886 ("fs/ntfs3: Add basic support for alternative data streams")
---
 fs/ntfs3/frecord.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index bead01a953f3f..5a88c875cb2a0 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -3430,6 +3430,10 @@ ssize_t ni_query_ads(struct ntfs_inode *ni, loff_t *pos, struct iov_iter *iter)
 			break;
 		}
 
+		/* copy_to_iter() below may have copied nothing. */
+		if (*pos < vbo)
+			break;
+
 		if (vbo + err > *pos) {
 			size_t off = *pos - vbo;
 			used = err - off;

base-commit: 22430ae5d90ab288b0ee2ad99ae941f4a666b694
-- 
2.43.0