Re: [PATCH] fs/ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()

[Hyunchul Lee]

2026년 7월 16일 (목) 오후 6:46, Alexandro Calò
<alexandro.calo@xxxxxxxxxxxxxxxxxx>님이 작성:
>
> From: Alexandro Calo <alexandro.calo@xxxxxxxxxxxxxxxxxx>
> Date: Thu, 16 Jul 2026 11:30:04 +0200
> Subject: [PATCH] fs/ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()
>
> ntfs_ir_to_ib copies all entries from index_root into a freshly allocated
> index_block_size-byte buffer without verifying that the entries fit in the
> available space. The entries in index_root may be larger than the usable
> entry space in the index block.
>
> This can cause OOB writes past the end of the allocation.
>
> The validator ntfs_index_root_inconsistent() checks that entries are
> self-consistent within the IR value, but never cross-checks them against
> index_block_size. There is no bounds check in ntfs_ir_to_ib() before the
> memcpy.
>
> Fixing this at the sink in ntfs_ir_to_ib() since
> ntfs_index_root_inconsistent() validates the logical consistency of
> index_root as a structure and a root with large entries is a structurally
> valid root. The bug is a size conflict of ntfs_ir_to_ib().
> Also, the validator is called once per inode load in
> ntfs_read_locked_inode() while ntfs_ir_to_ib() is only called during a
> reparent, a check there adds no overhead to the common path.
> Moreover, even a future call path that bypasses the validator would still
> be protected.
>
> This heap out-of-bounds write is triggered by a crafted filesystem image,
> which is not in the kernel threat model, anyway, fixing memory errors would
> be nice to keep  things secure.
>
> Signed-off-by: Alexandro Calo <alexandro.calo@xxxxxxxxxxxxxxxxxx>
> ---
>  fs/ntfs/index.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/fs/ntfs/index.c b/fs/ntfs/index.c
> index faa7ee920a3a..529697b5891e 100644
> --- a/fs/ntfs/index.c
> +++ b/fs/ntfs/index.c
> @@ -1112,6 +1112,7 @@ static struct index_block *ntfs_ir_to_ib(struct index_root *ir, s64 ib_vcn)
>         struct index_entry *ie_last;
>         char *ies_start, *ies_end;
>         int i;
> +       u32 ib_cap;
>
>         ntfs_debug("Entering\n");
>
> @@ -1127,6 +1128,15 @@ static struct index_block *ntfs_ir_to_ib(struct index_root *ir, s64 ib_vcn)
>          * as well, which can never have any data.
>          */
>         i = (char *)ie_last - ies_start + le16_to_cpu(ie_last->length);
> +
> +       /* Entries must fit in the allocated index block */
> +       ib_cap = le32_to_cpu(ib->index.allocated_size)
> +               - le32_to_cpu(ib->index.entries_offset);
> +       if ((u32)i > ib_cap) {
> +               kvfree(ib

Could you add an error message?
Other than that, it looks good to me.

Reviewed-by: Hyunchul Lee <hyc.lee@xxxxxxxxx>

> +               return NULL;
> +       }
> +
>         memcpy(ntfs_ie_get_first(&ib->index), ies_start, i);
>
>         ib->index.flags = ir->index.flags;
>
> base-commit: 37e2f878a7a660a216cc7a60459995fefd150f25
> --
> 2.47.3
>


-- 
Thanks,
Hyunchul