[PATCH 0/1] fs/ntfs3: fix OOB writes in do_action() log replay via unvalidated trailing index entry

[Tabriz Hasanli]

Hi Willy, Konstantin,

Thank you for the quick and detailed feedback.

First, apologies about the display name — it was a placeholder from
when I first created the account.  I have since updated it to my real
name: Tabriz Hasanli.

As requested, here is the fix as a proper git format-patch against
mainline (cf72cbb39).  A single patch addresses both check_if_alloc_index()
and check_if_root_index() since they share the same root cause and
the same fix pattern.

Per your note that crafted-FS issues are outside the private
disclosure threat model, I am sending this to the public lists.

Summary of the bug:

check_if_alloc_index() and check_if_root_index() do not stop at
de_is_last() and do not validate the target entry at attr_off.
This allows a crafted NTFS image's $LogFile to direct four
do_action() write operations to an attacker-controlled fake entry
in the trailing gap, producing heap OOB writes of 8 or 56 bytes
during mount.

These are variant siblings of the view.data_off fix (3e127829e57f)
and the DeleteIndexEntryAllocation fix (fc4626bb3656).

Confirmed with userspace ASan harnesses using kernel-faithful
512-byte INDEX_BUFFER geometry (fix_off=0x28, fix_num=2, full
check_index_buffer gate chain).  Harness source files are
available on request.

Thanks,
Tabriz

Tabriz Hasanli (1):
  fs/ntfs3: validate target index entry in
    check_if_alloc_index/check_if_root_index

 fs/ntfs3/fslog.c | 42 ++++++++++++++++++++++++++++++++++++------
 1 file changed, 36 insertions(+), 6 deletions(-)

--
2.53.0