[PATCH ntfs] fs/ntfs3: fix slab-out-of-bounds write in attr_insert_range()

[PATCH ntfs] fs/ntfs3: fix slab-out-of-bounds write in attr_insert_range()

[Xiang Mei (Microsoft)]

When fallocate(FALLOC_FL_INSERT_RANGE) grows a still-resident ntfs3
attribute, attr_insert_range() shifts the inline data using the insert
length 'bytes' as both the destination offset and the copy size:

  memmove(data + bytes, data, bytes);

Both are wrong: the shift must start at the insertion point 'vbo' and
move only the data past it (data_size - vbo). When bytes > data_size the
memmove runs off the end of the data_size + bytes buffer and overflows
the adjacent slab object.

Since vbo < data_size is already enforced above, the reworked offsets stay
within the data_size + bytes buffer and cannot under/overflow.

  BUG: KASAN: slab-out-of-bounds in attr_insert_range (fs/ntfs3/attrib.c:2581)
  Write of size 512 at addr ffff8880135e8b10 by task exploit/142
   ...
   __asan_memmove (mm/kasan/shadow.c:95)
   attr_insert_range (fs/ntfs3/attrib.c:2581)
   ntfs_fallocate (fs/ntfs3/file.c:618)
   vfs_fallocate (fs/open.c:338)
   __x64_sys_fallocate (fs/open.c:362)
   ...

Fixes: 9256ec35359f ("fs/ntfs3: Refactoring attr_insert_range to restore after errors")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
---
 fs/ntfs3/attrib.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index c621a4c582f9..a9a2c2104fd6 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -2578,8 +2578,8 @@ int attr_insert_range(struct ntfs_inode *ni, u64 vbo, u64 bytes)
 			char *data = Add2Ptr(attr_b,
 					     le16_to_cpu(attr_b->res.data_off));
 
-			memmove(data + bytes, data, bytes);
-			memset(data, 0, bytes);
+			memmove(data + vbo + bytes, data + vbo, data_size - vbo);
+			memset(data + vbo, 0, bytes);
 			goto done;
 		}
 
-- 
2.43.0

Re: [PATCH ntfs] fs/ntfs3: fix slab-out-of-bounds write in attr_insert_range()

[Konstantin Komarov]

On 7/10/26 00:05, Xiang Mei (Microsoft) wrote:

> When fallocate(FALLOC_FL_INSERT_RANGE) grows a still-resident ntfs3
> attribute, attr_insert_range() shifts the inline data using the insert
> length 'bytes' as both the destination offset and the copy size:
>
>    memmove(data + bytes, data, bytes);
>
> Both are wrong: the shift must start at the insertion point 'vbo' and
> move only the data past it (data_size - vbo). When bytes > data_size the
> memmove runs off the end of the data_size + bytes buffer and overflows
> the adjacent slab object.
>
> Since vbo < data_size is already enforced above, the reworked offsets stay
> within the data_size + bytes buffer and cannot under/overflow.
>
>    BUG: KASAN: slab-out-of-bounds in attr_insert_range (fs/ntfs3/attrib.c:2581)
>    Write of size 512 at addr ffff8880135e8b10 by task exploit/142
>     ...
>     __asan_memmove (mm/kasan/shadow.c:95)
>     attr_insert_range (fs/ntfs3/attrib.c:2581)
>     ntfs_fallocate (fs/ntfs3/file.c:618)
>     vfs_fallocate (fs/open.c:338)
>     __x64_sys_fallocate (fs/open.c:362)
>     ...
>
> Fixes: 9256ec35359f ("fs/ntfs3: Refactoring attr_insert_range to restore after errors")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
> ---
>   fs/ntfs3/attrib.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
> index c621a4c582f9..a9a2c2104fd6 100644
> --- a/fs/ntfs3/attrib.c
> +++ b/fs/ntfs3/attrib.c
> @@ -2578,8 +2578,8 @@ int attr_insert_range(struct ntfs_inode *ni, u64 vbo, u64 bytes)
>   			char *data = Add2Ptr(attr_b,
>   					     le16_to_cpu(attr_b->res.data_off));
>   
> -			memmove(data + bytes, data, bytes);
> -			memset(data, 0, bytes);
> +			memmove(data + vbo + bytes, data + vbo, data_size - vbo);
> +			memset(data + vbo, 0, bytes);
>   			goto done;
>   		}
>   

Hello,

The patch was applied, thank you.

Regards,
Konstantin