Re: [PATCH v2] ntfs3: fix buffer overflow in CreateAttribute validation

[Konstantin Komarov <almaz.alexandrovich@paragon-software.com>]

On 8/13/26 11:41, Hongling Zeng wrote:

> In the CreateAttribute action, the validation checks whether dlen
> fits within the available MFT record space, but the actual memcpy
> uses asize (the attribute size from the log record) as the copy length.
>
> A malicious NTFS journal record can set a small dlen to pass the
> validation while setting a large asize that exceeds the MFT record
> buffer size, causing a buffer overflow when memcpy copies asize bytes
> into the destination buffer.
>
> The validation must use the same size that is later passed to memcpy().
>
> Fix this by using asize in the bounds check instead of dlen, since
> asize is the actual length used by memcpy. The source buffer boundary
> is already validated by the existing check:
>        Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len)
>
> Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
> ---
> Change in v2:
>   Also fix the lower bound check to use asize instead of dlen. A malicious
>   log record with dlen >= 24 (passing dlen < SIZE_OF_RESIDENT check) but
>   asize < 24 could allocate insufficient memory and trigger OOB accesses
>   in subsequent operations.
> ---
>   fs/ntfs3/fslog.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
> index 3440212ecb12..e15f7621863e 100644
> --- a/fs/ntfs3/fslog.c
> +++ b/fs/ntfs3/fslog.c
> @@ -3285,10 +3285,10 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
>   		asize = le32_to_cpu(attr2->size);
>   		used = le32_to_cpu(rec->used);
>   
> -		if (!check_if_attr(rec, lrh) || dlen < SIZEOF_RESIDENT ||
> +		if (!check_if_attr(rec, lrh) || asize < SIZEOF_RESIDENT ||
>   		    !IS_ALIGNED(asize, 8) ||
>   		    Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len) ||
> -		    dlen > record_size - used) {
> +		    asize > record_size - used) {
>   			goto dirty_vol;
>   		}
>   

Hello,

Sorry for the delay.
Your patch was applied, thanks.

Regards,
Konstantin