Re: [PATCH] ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head

Konstantin Komarov
2026-04-30T12:00:06Z

On 4/18/26 01:33, Michael Bommarito wrote:

> indx_insert_into_root() promotes a full resident $INDEX_ROOT into
> $INDEX_ALLOCATION and copies all non-last resident root entries into
> a newly allocated INDEX_BUFFER via hdr_insert_head(). The source
> byte count 'to_move' is summed from the on-disk resident entry sizes
> and is independent of the destination buffer size, which comes from
> root->index_block_size (via indx->index_bits).
>
> A crafted NTFS image that keeps a valid, full resident root but
> shrinks root->index_block_size down to 512 after the root has been
> populated makes hdr_insert_head() memcpy attacker-controlled resident
> entry bytes past the end of the kmalloc(1u << indx->index_bits)
> allocation returned by indx_new(). For a 512-byte destination and a
> resident root whose non-last entries total 560 bytes, the memcpy
> overruns by 120 bytes and a following memmove extends the highest
> written offset to 136 bytes past the allocation. The overflow bytes
> are a direct copy of on-disk entries (via kmemdup), so they are
> fully attacker-controlled.
>
> The write is reachable from unprivileged open(O_CREAT) on a mounted
> crafted NTFS image: a single sufficiently long create in a directory
> whose resident root is already full forces root promotion and
> triggers the copy.
>
> This is a controlled out-of-bounds write of 120-136 bytes past a
> kmalloc(index_block_size) allocation, with attacker-controlled
> content. It is a bounded adjacent-heap corruption primitive; it is
> not an arbitrary-address write. Successful exploitation into a named
> victim object depends on the surrounding slab layout.
>
> Reject the copy at the sink. The destination's INDEX_HDR already
> reports hdr_total (the payload capacity of the new buffer) and
> hdr_used (the bytes already consumed by the terminal END entry
> installed by indx_new()); require that to_move fits in the remaining
> payload before calling hdr_insert_head(). On mismatch, fail with
> -EINVAL and mark the filesystem as having a detected on-disk
> inconsistency, which is the same behaviour as the surrounding
> validation in this function.
>
> Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-7
> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
> ---
>
> - FYI, like the sp_size patch, I have a larger refactor that might
> make this easier to avoid long term. It's a mount-time variant
> that adds the cross-check between root->index_block_size and
> the resident root attribute size to indx_init() instead of the
> sink, closing the whole "root entries do not fit declared
> index_block_size" class for any future caller that reaches
> hdr_insert_head from elsewhere. Happy to send it as v2 if
> you prefer the wider change; otherwise, this minimal guard is
> scoped to the minimal memcpy overrun site and is easier to
> backport.
>
> fs/ntfs3/index.c | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
> diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
> index 2c43e7c27861..b7633b721d19 100644
> --- a/fs/ntfs3/index.c
> +++ b/fs/ntfs3/index.c
> @@ -1740,6 +1740,22 @@ static int indx_insert_into_root(struct ntfs_index *indx, struct ntfs_inode *ni,
> hdr_used = le32_to_cpu(hdr->used);
> hdr_total = le32_to_cpu(hdr->total);
>
> + /*
> + * The destination INDEX_BUFFER has 'hdr_total' bytes of payload
> + * available after the header, of which 'hdr_used' are already
> + * consumed by the single terminal END entry installed by
> + * indx_new(). A crafted image can present a resident root whose
> + * non-last entries (summing to 'to_move') exceed what fits in
> + * this buffer; copying them unchecked would overrun the
> + * kmalloc(1u << indx->index_bits) allocation backing the new
> + * buffer. Reject the copy in that case.
> + */
> + if (to_move > hdr_total - hdr_used) {
> + err = -EINVAL;
> + ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
> + goto out_put_n;
> + }
> +
> /* Copy root entries into new buffer. */
> hdr_insert_head(hdr, re, to_move);
>

Hello,

Sorry for the delay.
Your patch is queued for the next merge window, thanks.

Regards,
Konstantin