[PATCH 1/4] fs/ntfs3: validate dirty page open attribute offsets

[Giulia Aloia]

The dirty-page walk in log_replay() uses dp->target_attr as a byte
offset into the open attribute table without validating it first.
Checking oe->next already dereferences the unchecked pointer.

A malformed dirty-page entry can select the table header, the middle
of an entry, or data beyond the table. The lookup can then read an
invalid entry and follow a bogus attribute pointer.

A crafted table dump containing a fake open attribute entry at
bytes_per_rt(oatbl), within the larger dump buffer, produced the
following on x86-64 before the fix:

 KASAN: maybe wild-memory-access in range
        [0x4141414141414148-0x414141414141414f]
 RIP: 0010:log_replay+0xa698/0xe690
 Call Trace:
  ntfs_loadlog_and_replay+0x3e0/0x500
  ntfs_fill_super+0x1fd3/0x4510
  ...

Require the offset to be at or beyond the end of the table header,
below the logical table size, and aligned to the table's entry size.
Also require that each entry can hold an OPEN_ATTR_ENRTY; together
these checks keep the whole selected entry within the table. Reject
invalid offsets with -EINVAL, as the redo lookup does. Keep the existing
handling of unallocated entries and NULL attribute pointers.

This lookup uses dirty-page table entries and is separate from the
redo and undo log-record lookups discussed in the linked report.

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@xxxxxxxxxxxxxxx
Link: https://lore.kernel.org/all/20260901174934.6275-1-cenzhang@xxxxxxxxxxxxxxxxxxx/
Assisted-by: Bynario AI
Signed-off-by: Giulia Aloia <giulia@xxxxxxxx>
---
 fs/ntfs3/fslog.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index ed50c1d0c23e..8ac0dbd2f07f 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -4987,6 +4987,15 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
 	if (!dp)
 		goto do_redo_1;
 
+	t32 = le32_to_cpu(dp->target_attr);
+	t16 = le16_to_cpu(oatbl->size);
+	if (t16 < sizeof(*oe) || t32 < sizeof(*oatbl) ||
+	    t32 >= bytes_per_rt(oatbl) ||
+	    (t32 - sizeof(*oatbl)) % t16) {
+		err = -EINVAL;
+		goto out;
+	}
+
 	oe = Add2Ptr(oatbl, le32_to_cpu(dp->target_attr));
 
 	if (oe->next != RESTART_ENTRY_ALLOCATED_LE)
 		goto next_dirty_page;
-- 
2.55.0