Re: [PATCH] ntfs: validate final EA attribute size

2026=EB=85=84 7=EC=9B=94 16=EC=9D=BC (=EB=AA=A9) =EC=98=A4=EC=A0=84 11:47, =
Namjae Jeon <[email protected]>=EB=8B=98=EC=9D=B4 =EC=9E=91=EC=84=B1:
>
> A replacement first removes the existing EA record, then adds the
> replacement. Check the size of that final $EA stream before mutating
> the current stream.
>
> This avoids committing the shortened $EA stream or $EA_INFORMATION before
> discovering that the replacement exceeds the AttrDef size limit.
>
> Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations")
> Signed-off-by: Namjae Jeon <[email protected]>

Looks good to me.

Reviewed-by: Hyunchul Lee <[email protected]>


> ---
>  fs/ntfs/ea.c | 17 +++++++++++++++--
>  1 file changed, 15 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c
> index 0cd192752b7c..0eba3f41c7bb 100644
> --- a/fs/ntfs/ea.c
> +++ b/fs/ntfs/ea.c
> @@ -250,6 +250,14 @@ static int ntfs_set_ea(struct inode *inode, const ch=
ar *name, size_t name_len,
>                         goto out;
>                 }
>
> +               /* Check the final $EA size before removing the old entry=
. */
> +               if (val_size &&
> +                   ntfs_attr_size_bounds_check(ni->vol, AT_EA,
> +                                       ea_info_qsize - ea_size + new_ea_=
size)) {
> +                       err =3D -EFBIG;
> +                       goto out;
> +               }
> +
>                 p_ea =3D (struct ea_attr *)(ea_buf + ea_off);
>
>                 if (val_size &&
> @@ -285,6 +293,12 @@ static int ntfs_set_ea(struct inode *inode, const ch=
ar *name, size_t name_len,
>                         err =3D -ENODATA;
>                         goto out;
>                 }
> +
> +               if (ntfs_attr_size_bounds_check(ni->vol, AT_EA,
> +                                       ea_info_qsize + new_ea_size)) {
> +                       err =3D -EFBIG;
> +                       goto out;
> +               }
>         }
>         kvfree(ea_buf);
>
> @@ -312,8 +326,7 @@ static int ntfs_set_ea(struct inode *inode, const cha=
r *name, size_t name_len,
>         p_ea_info->ea_length =3D cpu_to_le16(ea_packed);
>         p_ea_info->ea_query_length =3D cpu_to_le32(ea_info_qsize + new_ea=
_size);
>
> -       if (ea_packed > 0xffff ||
> -           ntfs_attr_size_bounds_check(ni->vol, AT_EA, new_ea_size)) {
> +       if (ea_packed > 0xffff) {
>                 err =3D -EFBIG;
>                 goto out;
>         }
> --
> 2.25.1
>


--
Thanks,
Hyunchul