[PATCH] ntfs: check the file name against the key length of an index entry

[PATCH] ntfs: check the file name against the key length of an index entry

[Wahid Khan]

ntfs_index_entry_inconsistent() checks that the file name of a
$FILE_NAME key fits in the index entry. It does not check that the name
fits in the key, which is what key_length describes. Code that works on
the key alone relies on that.

ntfs_readdir() copies key_length bytes of the key of the next entry to
resume the enumeration, and later uses the copy to search the index. If
file_name_length is larger than the key holds, the name comparison reads
past the copy:

  BUG: KASAN: slab-out-of-bounds in ntfs_file_compare_values+0x2d1/0x4b0
  Read of size 2 at addr ffff88800a4ef2ce by task init/1
   ntfs_file_compare_values
   ntfs_collate
   ntfs_ie_lookup
   ntfs_index_lookup
   ntfs_readdir
   iterate_dir
  Allocated by task 1:
   kmemdup_noprof
   ntfs_readdir
  The buggy address is located 0 bytes to the right of
  allocated 78-byte region

Two bytes of an image from mkntfs are enough: in an entry whose name has
six characters (key_length 78), change file_name_length from 6 to 7, so
the key claims 80 bytes. The entry itself is 96 bytes, so the existing
check lets it pass. The next readdir of the directory reads the extra
bytes.

Check the name against key_length, and check that the key is large
enough to hold file_name_length in the first place.

Fixes: 0a8ac0c1fa0b ("ntfs: update directory operations")
Cc: stable@vger.kernel.org # v7.1+
Signed-off-by: Wahid Khan <wahidzk0091@gmail.com>
---
This is independent of the three-patch series I sent earlier today:
https://lore.kernel.org/all/20261106091420.2461683-1-wahidzk0091@gmail.com/

It touches the lines just above the "return -EIO" that
"[PATCH v5 19/31] ntfs: report index validation and block I/O errors"
changes to -EFSCORRUPTED, so one of the two needs a one-line rebase. I am
happy to do it on whichever lands first.

 fs/ntfs/index.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/fs/ntfs/index.c b/fs/ntfs/index.c
index 322cb371d..1abca298a 100644
--- a/fs/ntfs/index.c
+++ b/fs/ntfs/index.c
@@ -43,9 +43,11 @@ static int ntfs_index_entry_inconsistent(const struct ntfs_volume *vol,
 
 	} else {
 		if (collation_rule == COLLATION_FILE_NAME) {
-			if ((offsetof(struct index_entry, key.file_name.file_name) +
-			     ie->key.file_name.file_name_length	* sizeof(__le16)) >
-					le16_to_cpu(ie->length)) {
+			if (le16_to_cpu(ie->key_length) <
+			    offsetof(struct file_name_attr, file_name) ||
+			    (offsetof(struct file_name_attr, file_name) +
+			     ie->key.file_name.file_name_length * sizeof(__le16)) >
+					le16_to_cpu(ie->key_length)) {
 				ntfs_error(vol->sb,
 					"File name overflow from index entry in inode %lld\n",
 					(long long)inum);
-- 
2.53.0

Re: [PATCH] ntfs: check the file name against the key length of an index entry

[Namjae Jeon]

On Fri, Nov 6, 2026 at 8:28 PM Wahid Khan <wahidzk0091@gmail.com> wrote:
>
> ntfs_index_entry_inconsistent() checks that the file name of a
> $FILE_NAME key fits in the index entry. It does not check that the name
> fits in the key, which is what key_length describes. Code that works on
> the key alone relies on that.
>
> ntfs_readdir() copies key_length bytes of the key of the next entry to
> resume the enumeration, and later uses the copy to search the index. If
> file_name_length is larger than the key holds, the name comparison reads
> past the copy:
>
>   BUG: KASAN: slab-out-of-bounds in ntfs_file_compare_values+0x2d1/0x4b0
>   Read of size 2 at addr ffff88800a4ef2ce by task init/1
>    ntfs_file_compare_values
>    ntfs_collate
>    ntfs_ie_lookup
>    ntfs_index_lookup
>    ntfs_readdir
>    iterate_dir
>   Allocated by task 1:
>    kmemdup_noprof
>    ntfs_readdir
>   The buggy address is located 0 bytes to the right of
>   allocated 78-byte region
>
> Two bytes of an image from mkntfs are enough: in an entry whose name has
> six characters (key_length 78), change file_name_length from 6 to 7, so
> the key claims 80 bytes. The entry itself is 96 bytes, so the existing
> check lets it pass. The next readdir of the directory reads the extra
> bytes.
>
> Check the name against key_length, and check that the key is large
> enough to hold file_name_length in the first place.
>
> Fixes: 0a8ac0c1fa0b ("ntfs: update directory operations")
> Cc: stable@vger.kernel.org # v7.1+
> Signed-off-by: Wahid Khan <wahidzk0091@gmail.com>
Applied it to #ntfs-next.
Thanks!