From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5CCE831E827 for ; Fri, 3 Jul 2026 21:54:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783115677; cv=none; b=iPm75202AtF/PqndUAw7NWrpurY5/7Iecausi+IyYYKLTEDN9pjZR61sUBj+1dbVOALqSX1N9PWP4EpBz+gQRELVpKx0ZxKHRWRGAh1Bx2ADwh1lwJdqL9GcsR+RD5TX7JO1NlYoOQ+XJHMbtHpEv5BD9wl8wQ8lnaFUgX2+K0U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783115677; c=relaxed/simple; bh=x1EGwe9OWNv6GJQxJAcEXjNxhlsCTdMZzxoblkGcTGY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=AmxZ8NdIML+CGzh6MP7iG+nnr8z1VbJC9qn3ZwWPUadtm3AOMvqEGOQRGKWZUYyjjoL2cGL9Nln6IwiaAeaKYEzCcQVqY8Z3dgp/fe3dD/umpuRpsEkqLEROG7kjK+a1+O4bu3Na2ekbeXt65EV2ngtHHqAdSYExy6ragWYZ2rk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=AMDDnJn1; arc=none smtp.client-ip=209.85.216.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="AMDDnJn1" Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-381507c9380so491732a91.0 for ; Fri, 03 Jul 2026 14:54:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1783115674; x=1783720474; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=FBm+rN7FiRf19d3r1j1j1FGGiBV8PU79hN3KFt/7WGA=; b=AMDDnJn1o06Zi1gunkRTHMCO/ftYlefobYCsYH/8qiQs4fxNXhWc/hB5Qy0XbdxoRv V/cMVG6esEi/L6UjEywa4DcuDe6hMkTrT54d5v7J1sViPrpnUEMJvFI/HZdf7wi6uJDA q9Fd94rV+zyT02y7rSCUt3L8XFS6yHCCJs1hFSqAqndKypRZj4AX55DQTncv8145iyX0 RNFBqwi3sBHEWba9/Ge73MbllNRhuLzkkB+WSvExy+uyFnECYcwUVQmZaZwMkZz7zXib cpx2TTcHE8HCH6GBErqzHVuPAJNNro+tS1eryD5Hv7GBtKpFMD68bNzdoiXL9j0bQGpN ri6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783115675; x=1783720475; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=FBm+rN7FiRf19d3r1j1j1FGGiBV8PU79hN3KFt/7WGA=; b=cT6Skq/ta3IBMpXXX/7ROmSX4fPmvshFWZG3wzbE7BaFlhvVPdQ6psEVw/MLqzo5zN /uf+gANTwTnj2rWbui6wj7yUmGEgXQ+g0XnweAZE81dt4Gw0uR/33taag0bJJP8ID3y1 tSr6IvxF/IJg8VcjAJ9dKttqF48wrZr3hFligiW9Og5qgb4YM9V+CjzBpHGST8VVD5jC HFarMwsDq0eE1axccLS3qNzrBkRhE9NXduI4eciPcjVb7oimxKDCu2kvWeeT5bD8enud 9mQhUv9HbH5sJJs2tTdJCwVRJubpkaDDZCxlWEIYRig20Mipl/bitxRgvQCu/ZOzbJIq dpbQ== X-Gm-Message-State: AOJu0YwcQewHRTkMJYjZszwObn7ZrtTg9tLjGiZuvQ8jW+XdguhpONqt WbFf+kyeLjeqXb57tlVvmbFbbMxZ9Nn6zFPxTern4e8X11HrbJqAb4NRnpohsH2VGA== X-Gm-Gg: AfdE7cmJNKFvBtQIDu3ZtqF/fbJ2vIT14MD5zmfCM3rwgwPGbXpfBCMtMPK4KTWByAw xFUNulS2FLsJ4CUXJ/o0LMTqlCEEw0WK4uVUvWSwMPdtK0qiijUF+Ts+BLBwPy34XcwPrsKN9eW mVBan457w7rvUon3FH865anuoEvpX7HQ9C0pnsG+SeD9hNendEAsNyKjaik6OGOZL/DMda8M4Px +C4OIR7JvlwvkHJCbl+U7CCoJphaXRyJyCtzhY1+a8qLbIM8R2JXc+L1Ez4+HJvtaDGZJfaisgH l/hJxpPWjJLVxQH3Orpi8rExJgglea++hdvvf9qoEJT9NIzDznJ+hXeD3OdAFr6O6jnaTRMs9rC 1QzgauQ0e6QN5fTgqBAeDnlBQF3e89BSMmuJsfz0WjGs+wGN/Gm1LprFKLa5Tnzr1kMuRM/1m X-Received: by 2002:a17:90a:c2c7:b0:381:228e:ba20 with SMTP id 98e67ed59e1d1-3829f101e13mr976974a91.24.1783115674446; Fri, 03 Jul 2026 14:54:34 -0700 (PDT) Received: from p1.. ([2607:fb91:1556:80f:d8fb:4ffa:b012:f769]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-381071a5f60sm1287207a91.0.2026.07.03.14.54.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 03 Jul 2026 14:54:33 -0700 (PDT) From: Xiang Mei To: Konstantin Komarov , ntfs3@lists.linux.dev Cc: linux-kernel@vger.kernel.org, Weiming Shi , Xiang Mei Subject: [PATCH ntfs3] fs/ntfs3: validate $SDH entry size in ntfs_insert_security Date: Fri, 3 Jul 2026 14:54:31 -0700 Message-ID: <20260703215431.73681-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ntfs_insert_security() walks the $Secure::$SDH index and reads e->sec_hdr.size for every entry returned by indx_find()/indx_find_sort(). Those only guarantee the NTFS_DE envelope (e->size), so a crafted $SDH entry shorter than a full NTFS_DE_SDH at the tail of an index buffer makes the read of e->sec_hdr.size run past the allocation. Triggerable by an unprivileged setxattr(2) on a crafted NTFS image. BUG: KASAN: slab-out-of-bounds in ntfs_insert_security (fs/ntfs3/fsntfs.c:2148) Read of size 4 at addr ffff88800fa1de00 by task exploit/142 ntfs_insert_security (fs/ntfs3/fsntfs.c:2148) ntfs_setxattr (fs/ntfs3/xattr.c:947) __vfs_setxattr (fs/xattr.c:223) __vfs_setxattr_noperm (fs/xattr.c:257) vfs_setxattr (fs/xattr.c:344) filename_setxattr (fs/xattr.c:690) path_setxattrat (fs/xattr.c:734) __x64_sys_setxattr (fs/xattr.c:764) [...] The buggy address is located 0 bytes to the right of allocated 512-byte region [ffff88800fa1dc00, ffff88800fa1de00) Stop the scan when an entry is too small to hold a SECURITY_HDR. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Reported-by: Weiming Shi Signed-off-by: Xiang Mei --- fs/ntfs3/fsntfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c index bc7469d0a34d..6d81ae6c1f11 100644 --- a/fs/ntfs3/fsntfs.c +++ b/fs/ntfs3/fsntfs.c @@ -2145,6 +2145,9 @@ int ntfs_insert_security(struct ntfs_sb_info *sbi, goto out; while (e) { + if (le16_to_cpu(e->de.size) < SIZEOF_SDH_DIRENTRY) + break; + if (le32_to_cpu(e->sec_hdr.size) == new_sec_size) { err = ntfs_read_run_nb(sbi, &ni->file.run, le64_to_cpu(e->sec_hdr.off), -- 2.43.0