ntfs: mft: remove VLA usage

In the quest to remove all stack VLA usage from the kernel[1], this
allocates the maximum size stack buffer.  Existing checks already
require that blocksize >= NTFS_BLOCK_SIZE and mft_record_size <=
PAGE_SIZE, so max_bhs can be at most PAGE_SIZE / NTFS_BLOCK_SIZE.
Sanity checks are added for robustness.

[1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com

Link: http://lkml.kernel.org/r/20180626172909.41453-4-keescook@chromium.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Anton Altaparmakov <anton@tuxera.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 32c523c..fb14d17 100644 (file)
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -35,6 +35,8 @@
 #include "mft.h"
 #include "ntfs.h"
 
+#define MAX_BHS        (PAGE_SIZE / NTFS_BLOCK_SIZE)
+
 /**
  * map_mft_record_page - map the page in which a specific mft record resides
  * @ni:                ntfs inode whose mft record page to map
@@ -469,7 +471,7 @@ int ntfs_sync_mft_mirror(ntfs_volume *vol, const unsigned long mft_no,
        struct page *page;
        unsigned int blocksize = vol->sb->s_blocksize;
        int max_bhs = vol->mft_record_size / blocksize;
-       struct buffer_head *bhs[max_bhs];
+       struct buffer_head *bhs[MAX_BHS];
        struct buffer_head *bh, *head;
        u8 *kmirr;
        runlist_element *rl;
@@ -479,6 +481,8 @@ int ntfs_sync_mft_mirror(ntfs_volume *vol, const unsigned long mft_no,
 
        ntfs_debug("Entering for inode 0x%lx.", mft_no);
        BUG_ON(!max_bhs);
+       if (WARN_ON(max_bhs > MAX_BHS))
+               return -EINVAL;
        if (unlikely(!vol->mftmirr_ino)) {
                /* This could happen during umount... */
                err = ntfs_sync_mft_mirror_umount(vol, mft_no, m);
@@ -674,7 +678,7 @@ int write_mft_record_nolock(ntfs_inode *ni, MFT_RECORD *m, int sync)
        unsigned int blocksize = vol->sb->s_blocksize;
        unsigned char blocksize_bits = vol->sb->s_blocksize_bits;
        int max_bhs = vol->mft_record_size / blocksize;
-       struct buffer_head *bhs[max_bhs];
+       struct buffer_head *bhs[MAX_BHS];
        struct buffer_head *bh, *head;
        runlist_element *rl;
        unsigned int block_start, block_end, m_start, m_end;
@@ -684,6 +688,10 @@ int write_mft_record_nolock(ntfs_inode *ni, MFT_RECORD *m, int sync)
        BUG_ON(NInoAttr(ni));
        BUG_ON(!max_bhs);
        BUG_ON(!PageLocked(page));
+       if (WARN_ON(max_bhs > MAX_BHS)) {
+               err = -EINVAL;
+               goto err_out;
+       }
        /*
         * If the ntfs_inode is clean no need to do anything.  If it is dirty,
         * mark it as clean now so that it can be redirtied later on if needed.