[PATCH] fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass

[PATCH] fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass

[Michael Bommarito]

In log_replay()'s analysis pass, after find_dp() returns a
valid DIR_PAGE_ENTRY for the (target_attr, target_vcn) tuple,
the copy_lcns block walks lrh->lcns_follow further entries:

	t16 = le16_to_cpu(lrh->lcns_follow);
	for (i = 0; i < t16; i++) {
	    size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
	                        le64_to_cpu(dp->vcn));
	    dp->page_lcns[j + i] = lrh->page_lcns[i];
	}

find_dp() only validates that target_vcn falls within
[dp->vcn, dp->vcn + dp->lcns_follow), i.e., that the FIRST
cluster is covered.  The walk through the further entries is
not bounded against dp->lcns_follow.  For a malformed LRH
where target_vcn = dp->vcn + dp->lcns_follow - 1 and
lrh->lcns_follow > 1, the i > 0 writes overflow the dp's
allocated page_lcns[] array.

Add the missing j + lrh->lcns_follow <= dp->lcns_follow guard.

Reproduced under UML+KASAN on mainline 8d90b09e6741 as a
slab-out-of-bounds write of size 8 from log_replay+0x68d4 on
the mount path.

This is distinct from Pavitra Jha's 2026-05-02 patch
("fs/ntfs3: validate lcns_follow in log_replay conversion",
<20260502154252.164586-1-jhapavitra98@gmail.com>) which
addresses the separate version-0 dirty-page-table conversion
path's memmove(&dp->vcn, ...) call.  The two fixes are
complementary; both should land.

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
 fs/ntfs3/fslog.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index acfa18b84401e..f409611f2530d 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -4547,6 +4547,19 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
 		 * whole routine a loop, case Lcns do not fit below.
 		 */
 		t16 = le16_to_cpu(lrh->lcns_follow);
+		/*
+		 * find_dp() only validates that target_vcn is the first
+		 * cluster covered by dp.  The walk through lrh->lcns_follow
+		 * further entries must stay within the allocated
+		 * dp->page_lcns[] array, which is sized by dp->lcns_follow.
+		 */
+		if (le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn) + t16 >
+		    le32_to_cpu(dp->lcns_follow)) {
+			err = -EINVAL;
+			log->set_dirty = true;
+			goto out;
+		}
+
 		for (i = 0; i < t16; i++) {
 			size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
 					    le64_to_cpu(dp->vcn));
-- 
2.53.0

Re: [PATCH] fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass

[Konstantin Komarov]

On 5/15/26 18:34, Michael Bommarito wrote:

> In log_replay()'s analysis pass, after find_dp() returns a
> valid DIR_PAGE_ENTRY for the (target_attr, target_vcn) tuple,
> the copy_lcns block walks lrh->lcns_follow further entries:
>
> 	t16 = le16_to_cpu(lrh->lcns_follow);
> 	for (i = 0; i < t16; i++) {
> 	    size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
> 	                        le64_to_cpu(dp->vcn));
> 	    dp->page_lcns[j + i] = lrh->page_lcns[i];
> 	}
>
> find_dp() only validates that target_vcn falls within
> [dp->vcn, dp->vcn + dp->lcns_follow), i.e., that the FIRST
> cluster is covered.  The walk through the further entries is
> not bounded against dp->lcns_follow.  For a malformed LRH
> where target_vcn = dp->vcn + dp->lcns_follow - 1 and
> lrh->lcns_follow > 1, the i > 0 writes overflow the dp's
> allocated page_lcns[] array.
>
> Add the missing j + lrh->lcns_follow <= dp->lcns_follow guard.
>
> Reproduced under UML+KASAN on mainline 8d90b09e6741 as a
> slab-out-of-bounds write of size 8 from log_replay+0x68d4 on
> the mount path.
>
> This is distinct from Pavitra Jha's 2026-05-02 patch
> ("fs/ntfs3: validate lcns_follow in log_replay conversion",
> <20260502154252.164586-1-jhapavitra98@gmail.com>) which
> addresses the separate version-0 dirty-page-table conversion
> path's memmove(&dp->vcn, ...) call.  The two fixes are
> complementary; both should land.
>
> Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-7
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
> ---
>   fs/ntfs3/fslog.c | 13 +++++++++++++
>   1 file changed, 13 insertions(+)
>
> diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
> index acfa18b84401e..f409611f2530d 100644
> --- a/fs/ntfs3/fslog.c
> +++ b/fs/ntfs3/fslog.c
> @@ -4547,6 +4547,19 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
>   		 * whole routine a loop, case Lcns do not fit below.
>   		 */
>   		t16 = le16_to_cpu(lrh->lcns_follow);
> +		/*
> +		 * find_dp() only validates that target_vcn is the first
> +		 * cluster covered by dp.  The walk through lrh->lcns_follow
> +		 * further entries must stay within the allocated
> +		 * dp->page_lcns[] array, which is sized by dp->lcns_follow.
> +		 */
> +		if (le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn) + t16 >
> +		    le32_to_cpu(dp->lcns_follow)) {
> +			err = -EINVAL;
> +			log->set_dirty = true;
> +			goto out;
> +		}
> +
>   		for (i = 0; i < t16; i++) {
>   			size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
>   					    le64_to_cpu(dp->vcn));

Hello,

There was a conflict in patch apply, fixed it. Thanks for the patch.

Regards,
Konstantin