[PATCH] Fix OOB write if err == buflen in ntfs_readlink_hlp()

[PATCH] Fix OOB write if err == buflen in ntfs_readlink_hlp()

[Alexandro Calò]

From 64361f8e12081dc8828480588bc48c2c931ffc91 Mon Sep 17 00:00:00 2001
From: Alexandro Calo <alexandro.calo@nozominetworks.com>
Date: Wed, 8 Jul 2026 12:04:37 +0200
Subject: [PATCH] Fix OOB write if err == buflen in ntfs_readlink_hlp()

ntfs_utf16_to_nls() may return buflen. The caller later uses the returned
length as the index for writing the trailing NUL byte,
so err == buflen writes one byte past the end of buffer.

Fix this by limiting err to the last valid buffer index before writing
NUL.

ntfs_utf16_to_nls() returning a negative value is already handled by
if (err < 0) goto out;
As long as buflen is guaranteed to be nonzero the patch is fine.
As a defensive fix if(buflen==0) could be added.

This heap out-of-bounds write requires a crafted filesystem image,
which is not in the kernel threat model, but fixing memory errors would
be nice to keep things secure.

Signed-off-by: Alexandro Calo <alexandro.calo@nozominetworks.com>
---
 fs/ntfs3/inode.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 0c9bd669117d..d4803e1625fe 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -2029,6 +2029,9 @@ static noinline int ntfs_readlink_hlp(const struct dentry *link_de,
 	if (err < 0)
 		goto out;
 
+	if (err >= buflen)
+		err = buflen - 1;
+
 	/* Translate Windows '\' into Linux '/'. */
 	for (i = 0; i < err; i++) {
 		if (buffer[i] == '\\')

base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
-- 
2.47.3

Re: [PATCH] Fix OOB write if err == buflen in ntfs_readlink_hlp()

[Konstantin Komarov]

On 7/8/26 13:30, Alexandro Calò wrote:

> [You don't often get email from alexandro.calo@nozominetworks.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
>  From 64361f8e12081dc8828480588bc48c2c931ffc91 Mon Sep 17 00:00:00 2001
> From: Alexandro Calo <alexandro.calo@nozominetworks.com>
> Date: Wed, 8 Jul 2026 12:04:37 +0200
> Subject: [PATCH] Fix OOB write if err == buflen in ntfs_readlink_hlp()
>
> ntfs_utf16_to_nls() may return buflen. The caller later uses the returned
> length as the index for writing the trailing NUL byte,
> so err == buflen writes one byte past the end of buffer.
>
> Fix this by limiting err to the last valid buffer index before writing
> NUL.
>
> ntfs_utf16_to_nls() returning a negative value is already handled by
> if (err < 0) goto out;
> As long as buflen is guaranteed to be nonzero the patch is fine.
> As a defensive fix if(buflen==0) could be added.
>
> This heap out-of-bounds write requires a crafted filesystem image,
> which is not in the kernel threat model, but fixing memory errors would
> be nice to keep things secure.
>
> Signed-off-by: Alexandro Calo <alexandro.calo@nozominetworks.com>
> ---
>   fs/ntfs3/inode.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
> index 0c9bd669117d..d4803e1625fe 100644
> --- a/fs/ntfs3/inode.c
> +++ b/fs/ntfs3/inode.c
> @@ -2029,6 +2029,9 @@ static noinline int ntfs_readlink_hlp(const struct dentry *link_de,
>          if (err < 0)
>                  goto out;
>
> +       if (err >= buflen)
> +               err = buflen - 1;
> +
>          /* Translate Windows '\' into Linux '/'. */
>          for (i = 0; i < err; i++) {
>                  if (buffer[i] == '\\')
>
> base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
> --
> 2.47.3

Hello,

Sorry for the delay.
The patch is applied, thanks.

Regards,
Konstantin