[PATCH] fs/ntfs3: fix Out-Of-Bounds write in log_replay() via unvalidated data_off

[Pavitra Jha]

log_replay() applies UpdateRecordDataRoot and UpdateRecordDataAllocation
redo operations using a destination pointer derived from the on-disk field
e->view.data_off, which is a 16-bit value read from attacker-controlled
filesystem data:

    memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);

Neither check_if_index_root() nor check_if_root_index() validate
data_off against e->size. A crafted NTFS image can set data_off to
0xFFFF, causing memmove() to write attacker-controlled data out of
bounds of the NTFS_DE entry and its backing allocation.

The same unvalidated pattern exists in UpdateRecordDataAllocation.

ntfs3_bad_de_range() already exists to validate data_off and dlen
against e->size. Call it before each memmove(), bailing to dirty_vol on
violation. This mirrors the fix applied to DeleteIndexEntryRoot in
commit b2bc7c44ed17
("fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot").

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Pavitra Jha <jhapavitra98@xxxxxxxxx>
---
 fs/ntfs3/fslog.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 272e45276..c0237f7d0 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3487,6 +3487,9 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
 
 		e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
 
+		if (ntfs3_bad_de_range(e, dlen))
+			goto dirty_vol;
+
 		memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
 
 		mi->dirty = true;
@@ -3679,6 +3682,9 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
 			goto dirty_vol;
 		}
 
+		if (ntfs3_bad_de_range(e, dlen))
+			goto dirty_vol;
+
 		memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);
 
 		a_dirty = true;
-- 
2.53.0