[PATCH 2/2] fs/ntfs3: validate SetNewAttributeSizes payload length

[Giulia Aloia]

do_action() handles SetNewAttributeSizes by reading alloc_size,
valid_size and data_size from the redo or undo payload. It only treats
total_size as optional, but it does not first check that the payload is
large enough for the three fields it always consumes.

For LOG_RECORD_MULTI_PAGE records, find_log_rec() allocates exactly
client_data_len bytes. A crafted SetNewAttributeSizes undo record can keep
the undo payload within client_data_len while setting undo_len too small
for the fields read by do_action(), causing an out-of-bounds read.

Before this fix, mounting the crafted image on a KASAN build produced:

  BUG: KASAN: slab-out-of-bounds in do_action+0x7640/0x89e0
  Read of size 8 at addr ff11000101d94ed0 by task mount/61
  Call Trace:
   do_action+0x7640/0x89e0
   log_replay+0xcd38/0xe690
   ntfs_loadlog_and_replay+0x3e0/0x500
   ntfs_fill_super+0x1fd3/0x4510

The same report showed the object came from find_log_rec():

  Allocated by task 61:
   find_log_rec+0x17d/0x5f0
  The buggy address is located 0 bytes to the right of
   allocated 80-byte region [ff11000101d94e80, ff11000101d94ed0)

Reject SetNewAttributeSizes payloads that do not contain the three
fields it always reads. Keep the existing total_size check unchanged,
because that field is optional in the current replay code.

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Bynario AI
Signed-off-by: Giulia Aloia <giulia@xxxxxxxx>
---
 fs/ntfs3/fslog.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 88bd6ef98467..c5de4ebcc7ec 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3463,7 +3463,9 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
 
 	case SetNewAttributeSizes:
 		new_sz = data;
-		if (!check_if_attr(rec, lrh) || !attr->non_res)
+		if (!check_if_attr(rec, lrh) || !attr->non_res ||
+		    dlen < offsetof(struct NEW_ATTRIBUTE_SIZES, data_size) +
+				   sizeof(new_sz->data_size))
 			goto dirty_vol;
 
 		attr->nres.alloc_size = new_sz->alloc_size;
-- 
2.55.0