[PATCH] fs/ntfs3: check INDEX_ROOT resident size before use in ntfs_read_mft()

[PATCH] fs/ntfs3: check INDEX_ROOT resident size before use in ntfs_read_mft()

[Xiang Mei (Microsoft)]

When ntfs_read_mft() parses an ATTR_ROOT attribute it computes

	root = Add2Ptr(attr, roff);

using the on-disk resident data offset (roff = attr->res.data_off) and
then dereferences root->type and root->rule, and later passes root on to
indx_init(). Unlike the ATTR_STD and ATTR_NAME cases, which validate that
the resident data is large enough (asize >= sizeof(struct X) + roff and
rsize >= sizeof(struct X)) before accessing it, the ATTR_ROOT case has no
such check.

mi_enum_attr() only guarantees data_off + data_size <= attribute size, so
a crafted image can set data_off such that root lands at (or past) the end
of the MFT record's slab allocation while still passing that check (e.g.
data_size == 0). The subsequent read of root->type is then a
slab-out-of-bounds read, reported by KASAN when mounting the image:

  BUG: KASAN: slab-out-of-bounds in ntfs_iget5 (fs/ntfs3/inode.c:283)
  Read of size 4 at addr ffff88800c06a400 by task exploit/142
  Call Trace:
   ...  [KASAN report internals]
   ntfs_iget5 (fs/ntfs3/inode.c:283 fs/ntfs3/inode.c:542)
   ntfs_fill_super (fs/ntfs3/super.c:1690)
   get_tree_bdev_flags (fs/super.c:1634)
   vfs_get_tree (fs/super.c:1694)
   fc_mount (fs/namespace.c:1198)
   path_mount (fs/namespace.c:3765 ...)
   __x64_sys_mount (fs/namespace.c:4174 ...)
   do_syscall_64 (arch/x86/entry/syscall_64.c:63)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
  The buggy address is located 0 bytes to the right of
   allocated 1024-byte region [ffff88800c06a000, ffff88800c06a400)
   which belongs to the cache kmalloc-1k of size 1024

Validate the resident data size in the ATTR_ROOT case the same way the
neighbouring cases do, so that a truncated or mis-offset INDEX_ROOT is
rejected before root is dereferenced.

Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
---
 fs/ntfs3/inode.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index c43101cc064d..efb6a855c5ad 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -271,7 +271,9 @@ static struct inode *ntfs_read_mft(struct inode *inode,
 		break;
 
 	case ATTR_ROOT:
-		if (attr->non_res)
+		if (attr->non_res ||
+		    asize < sizeof(struct INDEX_ROOT) + roff ||
+		    rsize < sizeof(struct INDEX_ROOT))
 			goto out;
 
 		root = Add2Ptr(attr, roff);
-- 
2.43.0

Re: [PATCH] fs/ntfs3: check INDEX_ROOT resident size before use in ntfs_read_mft()

[Konstantin Komarov]

On 7/7/26 03:54, Xiang Mei (Microsoft) wrote:

> When ntfs_read_mft() parses an ATTR_ROOT attribute it computes
>
> 	root = Add2Ptr(attr, roff);
>
> using the on-disk resident data offset (roff = attr->res.data_off) and
> then dereferences root->type and root->rule, and later passes root on to
> indx_init(). Unlike the ATTR_STD and ATTR_NAME cases, which validate that
> the resident data is large enough (asize >= sizeof(struct X) + roff and
> rsize >= sizeof(struct X)) before accessing it, the ATTR_ROOT case has no
> such check.
>
> mi_enum_attr() only guarantees data_off + data_size <= attribute size, so
> a crafted image can set data_off such that root lands at (or past) the end
> of the MFT record's slab allocation while still passing that check (e.g.
> data_size == 0). The subsequent read of root->type is then a
> slab-out-of-bounds read, reported by KASAN when mounting the image:
>
>    BUG: KASAN: slab-out-of-bounds in ntfs_iget5 (fs/ntfs3/inode.c:283)
>    Read of size 4 at addr ffff88800c06a400 by task exploit/142
>    Call Trace:
>     ...  [KASAN report internals]
>     ntfs_iget5 (fs/ntfs3/inode.c:283 fs/ntfs3/inode.c:542)
>     ntfs_fill_super (fs/ntfs3/super.c:1690)
>     get_tree_bdev_flags (fs/super.c:1634)
>     vfs_get_tree (fs/super.c:1694)
>     fc_mount (fs/namespace.c:1198)
>     path_mount (fs/namespace.c:3765 ...)
>     __x64_sys_mount (fs/namespace.c:4174 ...)
>     do_syscall_64 (arch/x86/entry/syscall_64.c:63)
>     entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
>    The buggy address is located 0 bytes to the right of
>     allocated 1024-byte region [ffff88800c06a000, ffff88800c06a400)
>     which belongs to the cache kmalloc-1k of size 1024
>
> Validate the resident data size in the ATTR_ROOT case the same way the
> neighbouring cases do, so that a truncated or mis-offset INDEX_ROOT is
> rejected before root is dereferenced.
>
> Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
> ---
>   fs/ntfs3/inode.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
> index c43101cc064d..efb6a855c5ad 100644
> --- a/fs/ntfs3/inode.c
> +++ b/fs/ntfs3/inode.c
> @@ -271,7 +271,9 @@ static struct inode *ntfs_read_mft(struct inode *inode,
>   		break;
>   
>   	case ATTR_ROOT:
> -		if (attr->non_res)
> +		if (attr->non_res ||
> +		    asize < sizeof(struct INDEX_ROOT) + roff ||
> +		    rsize < sizeof(struct INDEX_ROOT))
>   			goto out;
>   
>   		root = Add2Ptr(attr, roff);

Hello,

Sorry for the delay.
Your patch was applied, thank you.

Regards,
Konstantin