All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg KH <gregkh@linuxfoundation.org>
To: "Cen Zhang (Microsoft Security FORGE Labs)"
	<cenzhang@linux.microsoft.com>
Cc: almaz.alexandrovich@paragon-software.com, ntfs3@lists.linux.dev,
	linux-kernel@vger.kernel.org, stable@vger.kernel.org,
	AutonomousCodeSecurity@microsoft.com, xmei5@asu.edu,
	tgopinath@linux.microsoft.com, kys@microsoft.com
Subject: Re: [PATCH] fs/ntfs3: validate target_attr in log_replay()
Date: Wed, 2 Sep 2026 07:53:58 +0200	[thread overview]
Message-ID: <2026090243-wilt-suds-f499@gregkh> (raw)
In-Reply-To: <20260901174934.6275-1-cenzhang@linux.microsoft.com>

On Tue, Sep 01, 2026 at 01:49:34PM -0400, Cen Zhang (Microsoft Security FORGE Labs) wrote:
> log_replay() treats lrh->target_attr as a byte offset to an
> OPEN_ATTR_ENRTY in the open-attribute restart table. A valid offset is
> the table header size plus an integral number of entries. The redo
> lookup checks only target_attr < bytes_per_rt(oatbl); its earlier
> alignment check subtracts the header size without first checking the
> lower bound, so the subtraction can wrap.
> 
> The undo lookup has no table-bound check, and its earlier alignment
> check is skipped when lcns_follow is zero. Unlike the redo lookup, it
> also does not reject unallocated entries or NULL entry pointers.
> 
> A crafted $LogFile can therefore point into the table header, the middle
> of an entry, or past the table and trigger an out-of-bounds access.

Why not fix the userspace fsck tool instead?

thanks,

greg k-h

      reply	other threads:[~2026-09-02  5:54 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-01 17:49 [PATCH] fs/ntfs3: validate target_attr in log_replay() Cen Zhang (Microsoft Security FORGE Labs)
2026-09-02  5:53 ` Greg KH [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2026090243-wilt-suds-f499@gregkh \
    --to=gregkh@linuxfoundation.org \
    --cc=AutonomousCodeSecurity@microsoft.com \
    --cc=almaz.alexandrovich@paragon-software.com \
    --cc=cenzhang@linux.microsoft.com \
    --cc=kys@microsoft.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=ntfs3@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    --cc=tgopinath@linux.microsoft.com \
    --cc=xmei5@asu.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.