[PATCH 1/2] ntfs3: add bounds check to prevent oob write in UpdateFileNameRoot
From: KRISH JAIN
Date: Tue Aug 18 2026 - 14:09:59 EST
The UpdateFileNameRoot and UpdateFileNameAllocation handlers in
do_action() perform a 56-byte memmove into an index entry's embedded
ATTR_FILE_NAME structure without verifying that the entry is large
enough to contain the write. If e->size is smaller than the required
80 bytes (sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, dup) +
sizeof(NTFS_DUP_INFO)), the memmove overflows into adjacent slab
objects in kmalloc-1024.
Add a bounds check before both memmove calls to validate that e->size
is sufficient, marking the volume dirty and aborting replay if not.
Fixes: 8d3ae59288f1 ("Linux 7.2")
Signed-off-by: KRISH JAIN <k3rn3lbr3ach3r@xxxxxxxxx>
Assisted-by: Claude:Opus4.6
---
fs/ntfs3/fslog.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index f038c799e..c32b59f4e 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3520,8 +3520,13 @@ static int do_action(struct ntfs_log *log, struct OP=
EN_ATTR_ENRTY *oe,
}
e =3D Add2Ptr(attr, le16_to_cpu(lrh->attr_off));
+ if (le16_to_cpu(e->size) <
+ sizeof(struct NTFS_DE) +
+ offsetof(struct ATTR_FILE_NAME, dup) +
+ sizeof(fname->dup))
+ goto dirty_vol;
fname =3D (struct ATTR_FILE_NAME *)(e + 1);
- memmove(&fname->dup, data, sizeof(fname->dup)); //
+ memmove(&fname->dup, data, sizeof(fname->dup));
mi->dirty =3D true;
break;
@@ -3706,6 +3711,11 @@ static int do_action(struct ntfs_log *log, struct OP=
EN_ATTR_ENRTY *oe,
goto dirty_vol;
}
+ if (le16_to_cpu(e->size) <
+ sizeof(struct NTFS_DE) +
+ offsetof(struct ATTR_FILE_NAME, dup) +
+ sizeof(fname->dup))
+ goto dirty_vol;
fname =3D (struct ATTR_FILE_NAME *)(e + 1);
memmove(&fname->dup, data, sizeof(fname->dup));
--
2.53.0