[PATCH v2] ntfs3: fix buffer overflow in CreateAttribute validation

[PATCH v2] ntfs3: fix buffer overflow in CreateAttribute validation

[Hongling Zeng]

In the CreateAttribute action, the validation checks whether dlen
fits within the available MFT record space, but the actual memcpy
uses asize (the attribute size from the log record) as the copy length.

A malicious NTFS journal record can set a small dlen to pass the
validation while setting a large asize that exceeds the MFT record
buffer size, causing a buffer overflow when memcpy copies asize bytes
into the destination buffer.

The validation must use the same size that is later passed to memcpy().

Fix this by using asize in the bounds check instead of dlen, since
asize is the actual length used by memcpy. The source buffer boundary
is already validated by the existing check:
      Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len)

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
Change in v2:
 Also fix the lower bound check to use asize instead of dlen. A malicious
 log record with dlen >= 24 (passing dlen < SIZE_OF_RESIDENT check) but
 asize < 24 could allocate insufficient memory and trigger OOB accesses
 in subsequent operations.
---
 fs/ntfs3/fslog.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 3440212ecb12..e15f7621863e 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3285,10 +3285,10 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
 		asize = le32_to_cpu(attr2->size);
 		used = le32_to_cpu(rec->used);
 
-		if (!check_if_attr(rec, lrh) || dlen < SIZEOF_RESIDENT ||
+		if (!check_if_attr(rec, lrh) || asize < SIZEOF_RESIDENT ||
 		    !IS_ALIGNED(asize, 8) ||
 		    Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len) ||
-		    dlen > record_size - used) {
+		    asize > record_size - used) {
 			goto dirty_vol;
 		}
 
-- 
2.25.1

Re: [PATCH v2] ntfs3: fix buffer overflow in CreateAttribute validation

[Konstantin Komarov]

On 8/13/26 11:41, Hongling Zeng wrote:

> In the CreateAttribute action, the validation checks whether dlen
> fits within the available MFT record space, but the actual memcpy
> uses asize (the attribute size from the log record) as the copy length.
>
> A malicious NTFS journal record can set a small dlen to pass the
> validation while setting a large asize that exceeds the MFT record
> buffer size, causing a buffer overflow when memcpy copies asize bytes
> into the destination buffer.
>
> The validation must use the same size that is later passed to memcpy().
>
> Fix this by using asize in the bounds check instead of dlen, since
> asize is the actual length used by memcpy. The source buffer boundary
> is already validated by the existing check:
>        Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len)
>
> Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
> ---
> Change in v2:
>   Also fix the lower bound check to use asize instead of dlen. A malicious
>   log record with dlen >= 24 (passing dlen < SIZE_OF_RESIDENT check) but
>   asize < 24 could allocate insufficient memory and trigger OOB accesses
>   in subsequent operations.
> ---
>   fs/ntfs3/fslog.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
> index 3440212ecb12..e15f7621863e 100644
> --- a/fs/ntfs3/fslog.c
> +++ b/fs/ntfs3/fslog.c
> @@ -3285,10 +3285,10 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
>   		asize = le32_to_cpu(attr2->size);
>   		used = le32_to_cpu(rec->used);
>   
> -		if (!check_if_attr(rec, lrh) || dlen < SIZEOF_RESIDENT ||
> +		if (!check_if_attr(rec, lrh) || asize < SIZEOF_RESIDENT ||
>   		    !IS_ALIGNED(asize, 8) ||
>   		    Add2Ptr(attr2, asize) > Add2Ptr(lrh, rec_len) ||
> -		    dlen > record_size - used) {
> +		    asize > record_size - used) {
>   			goto dirty_vol;
>   		}
>   

Hello,

Sorry for the delay.
Your patch was applied, thanks.

Regards,
Konstantin