[PATCH 0/2] fs/ntfs3: fix log replay payload overreads

[Giulia Aloia <giulia@bynar.io>]

This series fixes two journal replay paths that can read past crafted
redo or undo payloads while mounting a dirty NTFS volume.

Patch 1 validates that redo and undo payload ranges stay within the log
record before replay uses them, while preserving the compensation-log
record undo exception used by Windows. It also validates the fixed-size
OpenNonresidentAttribute redo entry and optional undo name before the
analysis pass copies them.

Patch 2 validates the minimum payload length for SetNewAttributeSizes,
which always reads alloc_size, valid_size and data_size but previously
only checked whether the optional total_size field was present.

The two checks are complementary. Patch 1 makes sure the selected
payload range is inside the log record when that range is expected to be
present. Patch 2 makes sure that the selected range is large enough for
the SetNewAttributeSizes operation that interprets it.

Both issues are reachable while mounting crafted images. Each patch
contains the KASAN report observed before the fix. With these patches,
the same images are rejected during mount without sanitizer reports.

Giulia Aloia (2):
  fs/ntfs3: fix out-of-bounds read of redo/undo data during log replay
  fs/ntfs3: validate SetNewAttributeSizes payload length

 fs/ntfs3/fslog.c | 35 ++++++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

-- 
2.55.0