[PATCH 3/4] fs/ntfs3: validate on-disk restart tables before use

[Giulia Aloia <giulia@bynar.io>]

log_replay() locates restart-table dumps using redo_off and passes the
remaining record length to check_rstbl(). However, check_log_rec() does
not ensure that redo_off leaves room for a complete RESTART_TABLE
header. check_rstbl() reads the header fields before validating the
table size, so a truncated dump or an offset beyond the record can
cause an out-of-bounds read.

Before passing an on-disk restart table to check_rstbl(), require
redo_off to leave enough bytes in the log record for a complete
RESTART_TABLE header. Apply this to the transaction, dirty-page and
open-attribute table dumps.

For the open-attribute table, also require the table entry size to be
at least as large as the expected entry size for the restart-area
version. This ensures that each slot is large enough for the entry
format used when converting and initializing the table.

check_rstbl() also accepts transaction tables whose entry size differs
from sizeof(struct TRANSACTION_ENTRY). check_log_rec() aligns transact_id
to that structure size, not the on-disk entry size. Accessing smaller
entries can read or write past their end. Larger entries can make an
accepted offset point into the middle of a slot and leave too little
space for the transaction fields. Require the entry size to equal
sizeof(struct TRANSACTION_ENTRY) when loading the table. This also
protects accesses to existing transaction entries, which bypass
alloc_rsttbl_from_idx().

This is reachable by mounting the crafted image on an x86-64 KASAN
kernel before this fix:

KASAN: slab-out-of-bounds in log_replay+0x8094/0xe690
    Write of size 8 at addr ffff888101107680 by task mount/67
Call Trace:
 log_replay+0x8094/0xe690
 ntfs_loadlog_and_replay+0x3e0/0x500
 ntfs_fill_super+0x1fd3/0x4510
 ...

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Assisted-by: Bynario AI
Signed-off-by: Giulia Aloia <giulia@bynar.io>
---
 fs/ntfs3/fslog.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 8dd233ec7d2f..e3b5a19f0e30 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -4274,12 +4274,17 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
 	}
 
 	t16 = le16_to_cpu(lrh->redo_off);
+	if (t16 > rec_len || rec_len - t16 < sizeof(*rt)) {
+		err = -EINVAL;
+		goto out;
+	}
 
 	rt = Add2Ptr(lrh, t16);
 	t32 = rec_len - t16;
 
 	/* Now check that this is a valid restart table. */
-	if (!check_rstbl(rt, t32)) {
+	if (le16_to_cpu(rt->size) != sizeof(struct TRANSACTION_ENTRY) ||
+	    !check_rstbl(rt, t32)) {
 		err = -EINVAL;
 		goto out;
 	}
@@ -4314,6 +4319,10 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
 	}
 
 	t16 = le16_to_cpu(lrh->redo_off);
+	if (t16 > rec_len || rec_len - t16 < sizeof(*rt)) {
+		err = -EINVAL;
+		goto out;
+	}
 
 	rt = Add2Ptr(lrh, t16);
 	t32 = rec_len - t16;
@@ -4441,11 +4450,16 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
 	}
 
 	t16 = le16_to_cpu(lrh->redo_off);
+	if (t16 > rec_len || rec_len - t16 < sizeof(*rt)) {
+		err = -EINVAL;
+		goto out;
+	}
 
 	rt = Add2Ptr(lrh, t16);
 	oatbl_bytes = rec_len - t16;
 
-	if (!check_rstbl(rt, oatbl_bytes)) {
+	if (le16_to_cpu(rt->size) < bytes_per_attr_entry ||
+	    !check_rstbl(rt, oatbl_bytes)) {
 		err = -EINVAL;
 		goto out;
 	}
-- 
2.55.0