[PATCH] ntfs3: cap RESTART_TABLE free-chain walker at rt->used

[PATCH] ntfs3: cap RESTART_TABLE free-chain walker at rt->used

[Michael Bommarito]

A crafted NTFS3 disk image triggers an in-kernel infinite loop at
mount time, hanging the mounting thread and firing the soft-lockup
watchdog within ~22s on multi-CPU hosts (panic with
kernel.softlockup_panic=1).  The bug is reachable from desktop USB
auto-mount on distributions where udisks2 routes the NTFS signature
to the in-tree ntfs3 driver (Arch family and an increasing fraction
of Fedora / openSUSE / RHEL deployments); CAP_SYS_ADMIN-class manual
mount elsewhere.

check_rstbl()'s second walker iterates the free-entry singly-linked
list headed by rt->first_free with no upper bound on iteration count:

  for (off = ff; off;) {
      if (off == RESTART_ENTRY_ALLOCATED)
          return false;
      off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));
      if (off > ts - sizeof(__le32))
          return false;
  }

The existing guards cover three exits: end-of-list (off == 0), the
in-use marker (off == RESTART_ENTRY_ALLOCATED), and out-of-bounds
(off > ts - sizeof(__le32)).  None of the three prevents an
in-bounds cycle.

A crafted on-disk RESTART_TABLE whose free chain contains a
self-loop or A->B->A cycle whose offsets satisfy:

  - in range [sizeof(struct RESTART_TABLE), ts - sizeof(__le32)]
  - (off - sizeof(struct RESTART_TABLE)) % rsize == 0

passes all existing guards and spins the mount-time thread forever.
Reproduced in UML by hand-forging a 2 MB NTFS3 image whose journal
RESTART_TABLE first_free = 0x18 and whose entry at offset 0x18
stores 0x18 as its next pointer; mount of the forged image with
the in-tree ntfs3 driver never returns.

Bound the walker by rt->used.  Each entry on a legitimate free
chain is unique, and the total slot count is ne = le16_to_cpu
(rt->used).  A traversal that visits more than ne slots is by
construction malformed; reject it as a corrupt RESTART_TABLE.

After this patch, mount of the forged image returns with -EINVAL
and a log_replay failure message, and mkntfs-produced legitimate
images mount cleanly (verified in the same UML harness).

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-7
---
 fs/ntfs3/fslog.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index acfa18b84401e..d3d808d644dbf 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -764,8 +764,19 @@ static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes)
 	/*
 	 * Walk through the list headed by the first entry to make
 	 * sure none of the entries are currently being used.
+	 *
+	 * Bound traversal by ne (rt->used) to defeat a crafted on-disk
+	 * cycle in the free chain.  Each entry in a legitimate free
+	 * list is unique, so a chain that visits more than ne slots
+	 * is malformed.  Without this guard, an attacker-controlled
+	 * RESTART_TABLE with a self-loop or A->B->A cycle whose
+	 * offsets satisfy the existing alignment + in-bounds guards
+	 * spins forever at mount time.
 	 */
-	for (off = ff; off;) {
+	for (off = ff, i = 0; off; i++) {
+		if (i > ne)
+			return false;
+
 		if (off == RESTART_ENTRY_ALLOCATED)
 			return false;
 
-- 
2.53.0

Re: [PATCH] ntfs3: cap RESTART_TABLE free-chain walker at rt->used

[Konstantin Komarov]

On 5/18/26 01:41, Michael Bommarito wrote:

> A crafted NTFS3 disk image triggers an in-kernel infinite loop at
> mount time, hanging the mounting thread and firing the soft-lockup
> watchdog within ~22s on multi-CPU hosts (panic with
> kernel.softlockup_panic=1).  The bug is reachable from desktop USB
> auto-mount on distributions where udisks2 routes the NTFS signature
> to the in-tree ntfs3 driver (Arch family and an increasing fraction
> of Fedora / openSUSE / RHEL deployments); CAP_SYS_ADMIN-class manual
> mount elsewhere.
>
> check_rstbl()'s second walker iterates the free-entry singly-linked
> list headed by rt->first_free with no upper bound on iteration count:
>
>    for (off = ff; off;) {
>        if (off == RESTART_ENTRY_ALLOCATED)
>            return false;
>        off = le32_to_cpu(*(__le32 *)Add2Ptr(rt, off));
>        if (off > ts - sizeof(__le32))
>            return false;
>    }
>
> The existing guards cover three exits: end-of-list (off == 0), the
> in-use marker (off == RESTART_ENTRY_ALLOCATED), and out-of-bounds
> (off > ts - sizeof(__le32)).  None of the three prevents an
> in-bounds cycle.
>
> A crafted on-disk RESTART_TABLE whose free chain contains a
> self-loop or A->B->A cycle whose offsets satisfy:
>
>    - in range [sizeof(struct RESTART_TABLE), ts - sizeof(__le32)]
>    - (off - sizeof(struct RESTART_TABLE)) % rsize == 0
>
> passes all existing guards and spins the mount-time thread forever.
> Reproduced in UML by hand-forging a 2 MB NTFS3 image whose journal
> RESTART_TABLE first_free = 0x18 and whose entry at offset 0x18
> stores 0x18 as its next pointer; mount of the forged image with
> the in-tree ntfs3 driver never returns.
>
> Bound the walker by rt->used.  Each entry on a legitimate free
> chain is unique, and the total slot count is ne = le16_to_cpu
> (rt->used).  A traversal that visits more than ne slots is by
> construction malformed; reject it as a corrupt RESTART_TABLE.
>
> After this patch, mount of the forged image returns with -EINVAL
> and a log_replay failure message, and mkntfs-produced legitimate
> images mount cleanly (verified in the same UML harness).
>
> Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
> Cc: stable@vger.kernel.org
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
> Assisted-by: Claude:claude-opus-4-7
> ---
>   fs/ntfs3/fslog.c | 13 ++++++++++++-
>   1 file changed, 12 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
> index acfa18b84401e..d3d808d644dbf 100644
> --- a/fs/ntfs3/fslog.c
> +++ b/fs/ntfs3/fslog.c
> @@ -764,8 +764,19 @@ static bool check_rstbl(const struct RESTART_TABLE *rt, size_t bytes)
>   	/*
>   	 * Walk through the list headed by the first entry to make
>   	 * sure none of the entries are currently being used.
> +	 *
> +	 * Bound traversal by ne (rt->used) to defeat a crafted on-disk
> +	 * cycle in the free chain.  Each entry in a legitimate free
> +	 * list is unique, so a chain that visits more than ne slots
> +	 * is malformed.  Without this guard, an attacker-controlled
> +	 * RESTART_TABLE with a self-loop or A->B->A cycle whose
> +	 * offsets satisfy the existing alignment + in-bounds guards
> +	 * spins forever at mount time.
>   	 */
> -	for (off = ff; off;) {
> +	for (off = ff, i = 0; off; i++) {
> +		if (i > ne)
> +			return false;
> +
>   		if (off == RESTART_ENTRY_ALLOCATED)
>   			return false;
>   

Hello,

Your patch was applied, thank you.

Regards,
Konstantin