From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D3DA53A7F4C; Fri, 4 Sep 2026 05:19:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788499150; cv=none; b=C90GeTCdrpI9cIXHgopJoMIRdLiUxId34Wo/HdoIHY6adXVPrg/IpgUVJ1sn2CsSRecgcyojACJ/XAX95JU8sKf7wzKQq4y6R1g+22+MWKsleYgj2MiRYw4rCd6obD9HjZxxag3npUm6Laa7VKSOvsPhnO2nUgtVCsZOVfZ0Oow= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788499150; c=relaxed/simple; bh=RDBSBNJFevooElKdE3+iKoF1O8DxB8XksNSou/c7rsE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DYAw6q2YE/dlvsIXlr3ZwsgA8NDKTYZ5WNzTYZ1Vro6KZFVV/oUcJHTAp01IwsgQu/dHeGIFfBljpiR0gHbB0Ua26X7LmRgzHRZey2MuudDdI9vb8pd5qfR34Wn5TLYjdWaE4fMzOKzcGK8CLnf+hkNYuN/+eH3JKyIVBCuLF9E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TpD/O5qa; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="TpD/O5qa" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 39A141F00A3D; Fri, 4 Sep 2026 05:19:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788499148; bh=oXkv4H4HkBePUNJAY8DFqCcI3VV5OzP3723rtM8kfsE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=TpD/O5qaSVCMOeQc3eC/VXWwP6a0SGfAQj0Y7MPlaRkTW+JD1fPgxjE3oRGZoKq29 VD0bhmTmFFVuoXMZr/+1G+b9zEVDvnOicMLFDMrcSE6EKXA/GcKPFZItJJIo4zVr6U ztluGiXAzkZGm3WmkTm03eejVqfTieMhhOk6Xvug= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Samuel Page , Konstantin Komarov Subject: [PATCH 7.2 262/713] fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Date: Fri, 4 Sep 2026 06:53:50 +0200 Message-ID: <20260904045809.709954004@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260904045803.810145556@linuxfoundation.org> References: <20260904045803.810145556@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.2-stable review patch. If anyone has any objections, please let me know. ------------------ From: Samuel Page commit 35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd upstream. ni_read_frame() decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompress_lznt()'s return value: unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem, frame_size); if ((ssize_t)unc_size < 0) err = unc_size; else if (!unc_size || unc_size > frame_size) err = -EINVAL; decompress_lznt() stops as soon as the compressed stream is exhausted (e.g. a zero chunk header) and returns the number of bytes it actually wrote, which may be far less than frame_size. The bytes between unc_size and frame_size are never written. The only memset() that follows zeroes the region beyond i_valid; when the frame lies entirely within the file's valid size that memset() does not run, so the gap retains whatever was in the just-vmapped pages. All pages are then marked uptodate and returned to userspace, disclosing uninitialized (recently-freed) kernel page memory. A crafted compressed file whose stream decompresses to only a few bytes leaks the remainder of every frame on a plain read(2), which is enough to recover kernel pointers and defeat KASLR. Zero the [unc_size, frame_size) tail immediately after a successful LZNT decompress so the remainder reads back as zero. Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation") Cc: stable@vger.kernel.org Assisted-by: Bynario AI Signed-off-by: Samuel Page Signed-off-by: Konstantin Komarov Signed-off-by: Greg Kroah-Hartman --- fs/ntfs3/frecord.c | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -2443,6 +2443,15 @@ int ni_read_frame(struct ntfs_inode *ni, err = unc_size; else if (!unc_size || unc_size > frame_size) err = -EINVAL; + else if (unc_size < frame_size) { + /* + * Partial decompress: zero the [unc_size, frame_size) + * tail. decompress_lznt() leaves it untouched, so + * without this the freshly vmapped pages would expose + * uninitialized kernel memory to userspace. + */ + memset(frame_mem + unc_size, 0, frame_size - unc_size); + } } if (!err && valid_size < frame_vbo + frame_size) { size_t ok = valid_size - frame_vbo;