[PATCH] fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

[PATCH] fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

[hewei-gikaku]

From: HE WEI（ギカク） <skyexpoc@gmail.com>

ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size)
(== record_size) bytes and then walks every attribute of the primary MFT
record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor
by le_size(name_len), with no check against the end of the buffer; the
total size is only computed after the loop.

A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24)
bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32)
bytes in the list.  Because the number of attributes in a record is not
bounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless
minimum-size attributes), a crafted record packed with such attributes
produces a list larger than record_size and overflows the heap buffer.

This is reachable from a crafted, loop-mounted NTFS image: opening the file
and adding an attribute (e.g. via setxattr) drives ntfs_set_ea() ->
ni_insert_resident() -> ni_insert_attr() -> ni_ins_attr_ext() ->
ni_create_attr_list().

  BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48/0x1058
  Write of size 4 at addr ffff000008984c00 by task setfattr/345
   ni_create_attr_list+0xc48/0x1058
   ni_ins_attr_ext+0x510/0x7c0
   ni_insert_attr+0x3f8/0x70c
   ni_insert_resident+0xc8/0x3b0
   ntfs_set_ea+0x66c/0xd28
   ntfs_setxattr+0x4d8/0x5b0
   __arm64_sys_setxattr+0xa4/0x124
  Allocated by task 345:
   ni_create_attr_list+0x188/0x1058
  The buggy address belongs to the cache kmalloc-1k of size 1024
  (the write lands at object+1024).

Size the buffer from the actual attributes instead of assuming a single
record_size is always enough.

Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Reported-by: HE WEI（ギカク） <skyexpoc@gmail.com>
Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
---
 fs/ntfs3/frecord.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index 2e901d073fe9..6488d7a415c0 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -768,10 +768,23 @@ int ni_create_attr_list(struct ntfs_inode *ni)
 	rs = sbi->record_size;
 
 	/*
-	 * Skip estimating exact memory requirement.
-	 * Looks like one record_size is always enough.
+	 * Compute the exact size of the attribute list.  Each attribute in the
+	 * record yields one ATTR_LIST_ENTRY of le_size(name_len) bytes.  The
+	 * minimum on-disk attribute is SIZEOF_RESIDENT (0x18) bytes, but an
+	 * unnamed one expands to le_size(0) (0x20) here, so a record crafted
+	 * with many such attributes needs more than a single record_size; the
+	 * previous fixed kzalloc(record_size) could therefore be overflowed by
+	 * an attacker-controlled record.
 	 */
-	le = kzalloc(al_aligned(rs), GFP_NOFS);
+	lsize = 0;
+	attr = NULL;
+	while ((attr = mi_enum_attr(ni, &ni->mi, attr)))
+		lsize += le_size(attr->name_len);
+
+	if (!lsize)
+		return -EINVAL;
+
+	le = kzalloc(al_aligned(lsize), GFP_NOFS);
 	if (!le)
 		return -ENOMEM;
 
@@ -781,7 +794,6 @@ int ni_create_attr_list(struct ntfs_inode *ni)
 	attr = NULL;
 	nb = 0;
 	free_b = 0;
-	attr = NULL;
 
 	for (; (attr = mi_enum_attr(ni, &ni->mi, attr)); le = Add2Ptr(le, sz)) {
 		sz = le_size(attr->name_len);
-- 
2.43.0

Re: [PATCH] fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

[Konstantin Komarov]

On 6/10/26 02:29, hewei-gikaku wrote:

> From: HE WEI（ギカク） <skyexpoc@gmail.com>
>
> ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size)
> (== record_size) bytes and then walks every attribute of the primary MFT
> record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor
> by le_size(name_len), with no check against the end of the buffer; the
> total size is only computed after the loop.
>
> A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 = 24)
> bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 = 32)
> bytes in the list.  Because the number of attributes in a record is not
> bounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless
> minimum-size attributes), a crafted record packed with such attributes
> produces a list larger than record_size and overflows the heap buffer.
>
> This is reachable from a crafted, loop-mounted NTFS image: opening the file
> and adding an attribute (e.g. via setxattr) drives ntfs_set_ea() ->
> ni_insert_resident() -> ni_insert_attr() -> ni_ins_attr_ext() ->
> ni_create_attr_list().
>
>    BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48/0x1058
>    Write of size 4 at addr ffff000008984c00 by task setfattr/345
>     ni_create_attr_list+0xc48/0x1058
>     ni_ins_attr_ext+0x510/0x7c0
>     ni_insert_attr+0x3f8/0x70c
>     ni_insert_resident+0xc8/0x3b0
>     ntfs_set_ea+0x66c/0xd28
>     ntfs_setxattr+0x4d8/0x5b0
>     __arm64_sys_setxattr+0xa4/0x124
>    Allocated by task 345:
>     ni_create_attr_list+0x188/0x1058
>    The buggy address belongs to the cache kmalloc-1k of size 1024
>    (the write lands at object+1024).
>
> Size the buffer from the actual attributes instead of assuming a single
> record_size is always enough.
>
> Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
> Reported-by: HE WEI（ギカク） <skyexpoc@gmail.com>
> Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
> ---
>   fs/ntfs3/frecord.c | 20 ++++++++++++++++----
>   1 file changed, 16 insertions(+), 4 deletions(-)
>
> diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
> index 2e901d073fe9..6488d7a415c0 100644
> --- a/fs/ntfs3/frecord.c
> +++ b/fs/ntfs3/frecord.c
> @@ -768,10 +768,23 @@ int ni_create_attr_list(struct ntfs_inode *ni)
>          rs = sbi->record_size;
>
>          /*
> -        * Skip estimating exact memory requirement.
> -        * Looks like one record_size is always enough.
> +        * Compute the exact size of the attribute list.  Each attribute in the
> +        * record yields one ATTR_LIST_ENTRY of le_size(name_len) bytes.  The
> +        * minimum on-disk attribute is SIZEOF_RESIDENT (0x18) bytes, but an
> +        * unnamed one expands to le_size(0) (0x20) here, so a record crafted
> +        * with many such attributes needs more than a single record_size; the
> +        * previous fixed kzalloc(record_size) could therefore be overflowed by
> +        * an attacker-controlled record.
>           */
> -       le = kzalloc(al_aligned(rs), GFP_NOFS);
> +       lsize = 0;
> +       attr = NULL;
> +       while ((attr = mi_enum_attr(ni, &ni->mi, attr)))
> +               lsize += le_size(attr->name_len);
> +
> +       if (!lsize)
> +               return -EINVAL;
> +
> +       le = kzalloc(al_aligned(lsize), GFP_NOFS);
>          if (!le)
>                  return -ENOMEM;
>
> @@ -781,7 +794,6 @@ int ni_create_attr_list(struct ntfs_inode *ni)
>          attr = NULL;
>          nb = 0;
>          free_b = 0;
> -       attr = NULL;
>
>          for (; (attr = mi_enum_attr(ni, &ni->mi, attr)); le = Add2Ptr(le, sz)) {
>                  sz = le_size(attr->name_len);
> --
> 2.43.0

Hello,

Very sorry for the delay.
The patch was applied, thank you.

Regards,
Konstantin