[PATCH] fs/ntfs3: fix slab-out-of-bounds write in ntfs_create_inode

[Cen Zhang (Microsoft Security FORGE Labs)]

ntfs_create_inode() sizes the non-resident reparse run list as
record_size - offset - SIZEOF_NONRESIDENT, then sets the attribute size
to SIZEOF_NONRESIDENT + ALIGN(run_pack(), 8). It does not reserve space
for the trailing ATTR_END, so a maximally packed run list places that
4-byte sentinel just past the allocated MFT record.

BUG: KASAN: slab-out-of-bounds in ntfs_create_inode+0x4390/0x5220
  ntfs_create_inode+0x4390/0x5220 fs/ntfs3/inode.c:1796
  ntfs_symlink+0x108/0x170 fs/ntfs3/namei.c:224
  vfs_symlink+0x137/0x420
  filename_symlinkat+0x326/0x460
  __x64_sys_symlink+0x79/0xb0

After packing the run list, check that the 8-byte ATTR_END slot still
fits in the MFT record. Return -EINVAL if the aligned run list would
place it past the buffer.

Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Reported-by: Xiang Mei (Microsoft) <xmei5@xxxxxxx>
Cc: AutonomousCodeSecurity@xxxxxxxxxxxxx
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Cen Zhang (Microsoft Security FORGE Labs) <cenzhang@xxxxxxxxxxxxxxxxxxx>
---
 fs/ntfs3/inode.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 56b4f6469a28..d6e4b4b3154d 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -1769,6 +1769,11 @@ int ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir,
 			}
 
 			asize = SIZEOF_NONRESIDENT + ALIGN(err, 8);
+			if (asize + PtrOffset(rec, attr) + 8 >
+			    sbi->record_size) {
+				err = -EINVAL;
+				goto out5;
+			}
 			/* Write non resident data. */
 			err = ntfs_sb_write_run(sbi, &ni->file.run, 0, rp,
 						nsize, 0);

base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
-- 
2.55.0