Re: [PATCH] fs/ntfs3: validate target_attr in log_replay()

[Greg KH]

On Tue, Sep 01, 2026 at 01:49:34PM -0400, Cen Zhang (Microsoft Security FORGE Labs) wrote:
> log_replay() treats lrh->target_attr as a byte offset to an
> OPEN_ATTR_ENRTY in the open-attribute restart table. A valid offset is
> the table header size plus an integral number of entries. The redo
> lookup checks only target_attr < bytes_per_rt(oatbl); its earlier
> alignment check subtracts the header size without first checking the
> lower bound, so the subtraction can wrap.
> 
> The undo lookup has no table-bound check, and its earlier alignment
> check is skipped when lcns_follow is zero. Unlike the redo lookup, it
> also does not reject unallocated entries or NULL entry pointers.
> 
> A crafted $LogFile can therefore point into the table header, the middle
> of an entry, or past the table and trigger an out-of-bounds access.

Why not fix the userspace fsck tool instead?

thanks,

greg k-h