Re: [PATCH] fs/ntfs3: check INDEX_ROOT resident size before use in ntfs_read_mft()

[Konstantin Komarov <almaz.alexandrovich@paragon-software.com>]

On 7/7/26 03:54, Xiang Mei (Microsoft) wrote:

> When ntfs_read_mft() parses an ATTR_ROOT attribute it computes
>
> 	root = Add2Ptr(attr, roff);
>
> using the on-disk resident data offset (roff = attr->res.data_off) and
> then dereferences root->type and root->rule, and later passes root on to
> indx_init(). Unlike the ATTR_STD and ATTR_NAME cases, which validate that
> the resident data is large enough (asize >= sizeof(struct X) + roff and
> rsize >= sizeof(struct X)) before accessing it, the ATTR_ROOT case has no
> such check.
>
> mi_enum_attr() only guarantees data_off + data_size <= attribute size, so
> a crafted image can set data_off such that root lands at (or past) the end
> of the MFT record's slab allocation while still passing that check (e.g.
> data_size == 0). The subsequent read of root->type is then a
> slab-out-of-bounds read, reported by KASAN when mounting the image:
>
>    BUG: KASAN: slab-out-of-bounds in ntfs_iget5 (fs/ntfs3/inode.c:283)
>    Read of size 4 at addr ffff88800c06a400 by task exploit/142
>    Call Trace:
>     ...  [KASAN report internals]
>     ntfs_iget5 (fs/ntfs3/inode.c:283 fs/ntfs3/inode.c:542)
>     ntfs_fill_super (fs/ntfs3/super.c:1690)
>     get_tree_bdev_flags (fs/super.c:1634)
>     vfs_get_tree (fs/super.c:1694)
>     fc_mount (fs/namespace.c:1198)
>     path_mount (fs/namespace.c:3765 ...)
>     __x64_sys_mount (fs/namespace.c:4174 ...)
>     do_syscall_64 (arch/x86/entry/syscall_64.c:63)
>     entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
>    The buggy address is located 0 bytes to the right of
>     allocated 1024-byte region [ffff88800c06a000, ffff88800c06a400)
>     which belongs to the cache kmalloc-1k of size 1024
>
> Validate the resident data size in the ATTR_ROOT case the same way the
> neighbouring cases do, so that a truncated or mis-offset INDEX_ROOT is
> rejected before root is dereferenced.
>
> Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
> ---
>   fs/ntfs3/inode.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
> index c43101cc064d..efb6a855c5ad 100644
> --- a/fs/ntfs3/inode.c
> +++ b/fs/ntfs3/inode.c
> @@ -271,7 +271,9 @@ static struct inode *ntfs_read_mft(struct inode *inode,
>   		break;
>   
>   	case ATTR_ROOT:
> -		if (attr->non_res)
> +		if (attr->non_res ||
> +		    asize < sizeof(struct INDEX_ROOT) + roff ||
> +		    rsize < sizeof(struct INDEX_ROOT))
>   			goto out;
>   
>   		root = Add2Ptr(attr, roff);

Hello,

Sorry for the delay.
Your patch was applied, thank you.

Regards,
Konstantin