[PATCH 0/4] fs/ntfs3: tighten restart-table offset validation

[Giulia Aloia <giulia@bynar.io>]

This series makes NTFS3 journal replay safer when the on-disk restart
tables contain inconsistent offsets.

Patch 1 checks open attribute offsets in the dirty-page walk. Patch 2
checks transaction and attribute offsets in check_log_rec(), including
nonzero attribute offsets in records without LCNs, and validates
allocator offsets against the on-disk open-attribute table entry size.
Patch 3 rejects restart-table dumps without a complete header, rejects
short open-attribute entries, and requires the transaction-table entry
size to match TRANSACTION_ENTRY.
Patch 4 bounds the free-list walk used when allocating a specific
restart table entry.

Cen Zhang's earlier patch [1] checks target_attr at the redo and undo
lookups. This series adds checks in the dirty-page walk, in log record
validation, and in the restart table allocator. It can be applied
independently of [1], but [1] is still needed for the additional
validation at the redo and undo lookups.

Greg KH asked on that thread why this should be fixed in the kernel
rather than in userspace fsck. Checking and repairing a filesystem
before mounting it remains the administrator's responsibility. These
patches serve a narrower purpose: if journal replay encounters an
invalid offset, it should return an error instead of accessing invalid
memory. They do not repair the filesystem or replace fsck. I am
proposing them as robustness improvements, consistent with the kernel
threat model [2].

Each patch includes a KASAN trace captured using a crafted image before
the fix. With the series applied, those images were re-mounted on the
same x86-64 KASAN build with no reports. The series builds clean with
W=1 after each patch and passes checkpatch.pl --strict with
GIT_COMMIT_ID ignored for the KASAN addresses.

[1] https://lore.kernel.org/all/20260901174934.6275-1-cenzhang@linux.microsoft.com/
[2] https://docs.kernel.org/process/threat-model.html

Giulia Aloia (4):
  fs/ntfs3: validate dirty page open attribute offsets
  fs/ntfs3: validate restart table offsets in log records
  fs/ntfs3: validate on-disk restart tables before use
  fs/ntfs3: fix out-of-bounds access in alloc_rsttbl_from_idx()

 fs/ntfs3/fslog.c | 110 +++++++++++++++++++++++++++++++++++--------------------
 1 file changed, 70 insertions(+), 40 deletions(-)


base-commit: 238650ef6c7c7cca08e032527329424c9fbd70e5
-- 
2.55.0