[PATCH] fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

[PATCH] fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

[Weiming Shi]

read_log_rec_buf() copies a log record into a caller buffer starting at

	u32 off = lsn_to_page_off(log, lsn) + log->record_header_len;

log->record_header_len (and log->data_off, used for the following pages)
comes verbatim from the on-disk restart area and is only checked for
8-byte alignment in is_rst_area_valid(), so off can exceed
log->page_size. "tail = log->page_size - off" then underflows and
memcpy() reads past the page_size-sized buffer returned by
read_log_page(), spilling adjacent slab memory into the replay buffer.

This is reachable by mounting a crafted NTFS image:

 BUG: KASAN: slab-out-of-bounds in read_log_rec_buf+0x216/0x580
 Read of size 64 at addr ffff88800a877ff8 by task exploit/127
  read_log_rec_buf fs/ntfs3/fslog.c:2299
  log_replay fs/ntfs3/fslog.c:4216
  ntfs_loadlog_and_replay fs/ntfs3/fsntfs.c:324
  ntfs_fill_super fs/ntfs3/super.c:1392
  get_tree_bdev_flags fs/super.c:1694
  __x64_sys_mount fs/namespace.c:4360
 The buggy address is located 4088 bytes to the right of
 the 4096-byte region [ffff88800a876000, ffff88800a877000)

Reject an in-page offset outside the current page before the copy.

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Assisted-by: Claude:claude-opus-4-8
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 fs/ntfs3/fslog.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index f038c799e7ac..ee413dc80d3a 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -2276,7 +2276,15 @@ static int read_log_rec_buf(struct ntfs_log *log,
 	 */
 	for (;;) {
 		bool usa_error;
-		u32 tail = log->page_size - off;
+		u32 tail;
+
+		/* off comes from the on-disk restart area; bound it. */
+		if (off >= log->page_size) {
+			err = -EINVAL;
+			goto out;
+		}
+
+		tail = log->page_size - off;
 
 		if (tail >= data_len)
 			tail = data_len;
-- 
2.43.0

Re: [PATCH] fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

[Konstantin Komarov]

On 6/23/26 08:22, Weiming Shi wrote:

> [You don't often get email from bestswngs@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> read_log_rec_buf() copies a log record into a caller buffer starting at
>
>          u32 off = lsn_to_page_off(log, lsn) + log->record_header_len;
>
> log->record_header_len (and log->data_off, used for the following pages)
> comes verbatim from the on-disk restart area and is only checked for
> 8-byte alignment in is_rst_area_valid(), so off can exceed
> log->page_size. "tail = log->page_size - off" then underflows and
> memcpy() reads past the page_size-sized buffer returned by
> read_log_page(), spilling adjacent slab memory into the replay buffer.
>
> This is reachable by mounting a crafted NTFS image:
>
>   BUG: KASAN: slab-out-of-bounds in read_log_rec_buf+0x216/0x580
>   Read of size 64 at addr ffff88800a877ff8 by task exploit/127
>    read_log_rec_buf fs/ntfs3/fslog.c:2299
>    log_replay fs/ntfs3/fslog.c:4216
>    ntfs_loadlog_and_replay fs/ntfs3/fsntfs.c:324
>    ntfs_fill_super fs/ntfs3/super.c:1392
>    get_tree_bdev_flags fs/super.c:1694
>    __x64_sys_mount fs/namespace.c:4360
>   The buggy address is located 4088 bytes to the right of
>   the 4096-byte region [ffff88800a876000, ffff88800a877000)
>
> Reject an in-page offset outside the current page before the copy.
>
> Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
> Assisted-by: Claude:claude-opus-4-8
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
>   fs/ntfs3/fslog.c | 10 +++++++++-
>   1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
> index f038c799e7ac..ee413dc80d3a 100644
> --- a/fs/ntfs3/fslog.c
> +++ b/fs/ntfs3/fslog.c
> @@ -2276,7 +2276,15 @@ static int read_log_rec_buf(struct ntfs_log *log,
>           */
>          for (;;) {
>                  bool usa_error;
> -               u32 tail = log->page_size - off;
> +               u32 tail;
> +
> +               /* off comes from the on-disk restart area; bound it. */
> +               if (off >= log->page_size) {
> +                       err = -EINVAL;
> +                       goto out;
> +               }
> +
> +               tail = log->page_size - off;
>
>                  if (tail >= data_len)
>                          tail = data_len;
> --
> 2.43.0

Hello,

Sorry for the delay.
Your patch was applied, thanks.

Regards,
Konstantin