averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

fs/ntfs3: bound DeleteIndexEntryAllocation memmove length

Browse Source 
commit fc4626bb36 upstream.

In do_action()'s DeleteIndexEntryAllocation case, e->size comes
from an on-disk INDEX_BUFFER entry.  When e->size makes
e + e->size point past hdr + hdr->used,
PtrOffset(e1, Add2Ptr(hdr, used)) returns a negative ptrdiff_t
that is silently cast to a quasi-infinite size_t when passed
to memmove().  The memmove then walks past the destination
buffer.

The sibling DeleteIndexEntryRoot case at fslog.c:3540-3543
already carries the corresponding guard:

	if (PtrOffset(e1, Add2Ptr(hdr, used)) < esize ||
	    Add2Ptr(e, esize) > Add2Ptr(lrh, rec_len) ||
	    used + esize > le32_to_cpu(hdr->total)) {
		goto dirty_vol;
	}

Apply the same shape to the allocation-path case.  Also reject
esize == 0: memmove(e, e, ...) is a no-op and leaves
hdr->used unchanged, hiding a malformed entry from the
existing check_index_header() walk.

Reproduced under UML+KASAN on mainline 8d90b09e6741 by
mounting a crafted NTFS image: the unguarded memmove takes a
length of 0xffffffffffffff00 and the kernel oopses in
memmove+0x81/0x1a0 on the do_action+0x36a2 frame.

Fixes: b46acd6a6a ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
[almaz.alexandrovich@paragon-software.com: clang-formatted the changes]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Konstantin Komarov
2026-07-24 16:03:35 +02:00
committed by Greg Kroah-Hartman
parent af08e689ec
commit 4c8aac931c
1 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/ntfs3/fslog.c
+15 -1
View File
@@ -3574,9 +3574,23 @@ move_data:
}
e1 = Add2Ptr(e, esize);
nsize = esize;
used = le32_to_cpu(hdr->used);
/*
* Reject crafted entries whose e->size makes e + esize
* point past the INDEX_HDR's used boundary. Without this,
* PtrOffset(e1, hdr + used) underflows to a quasi-infinite
* size_t when fed to the memmove() below.
*
* Also reject esize == 0: memmove(e, e, ...) is a no-op and
* leaves hdr->used unchanged, masking the crafted entry.
*/
if (!esize || Add2Ptr(e, esize) > Add2Ptr(hdr, used) ||
PtrOffset(e1, Add2Ptr(hdr, used)) < esize)
goto dirty_vol;
nsize = esize;
memmove(e, e1, PtrOffset(e1, Add2Ptr(hdr, used)));
hdr->used = cpu_to_le32(used - nsize);