[PATCH] ntfs3: fix OOB write in attr_wof_frame_info()

[0xkato <0xkkato@gmail.com>]

In attr_wof_frame_info(), the offset-table read range for a nonresident
WofCompressedData stream is:

    u64 from = vbo[i] & ~(u64)(PAGE_SIZE - 1);
    u64 to   = min(from + PAGE_SIZE, wof_size);
    ...
    ntfs_read_run(sbi, run, addr, from, to - from);

A crafted image sets WofCompressedData.nres.data_size to 0xfff while the
file is large enough to request frame 1024 (offset 0x400000). This gives
from=0x1000, to=0xfff. The unsigned (to - from) wraps to 0xffffffffffffffff
and ntfs_read_write_run() overflows the single-page offs_folio via memcpy.

Triggered by pread() on a mounted NTFS image. Depending on adjacent
memory layout at the time of the overflow, KASAN reports this as
slab-out-of-bounds, use-after-free, or slab-use-after-free all at
ntfs_read_write_run(). Secondary corruption/panic paths were also observed.

Reject the read when the offset-table page is outside the stream.

Signed-off-by: 0xkato <0xkkato@gmail.com>
---
Reproducer:

  Create the crafted NTFS image:
    python3 create_wof_poc.py -o wof-poc.img

  Mount it read-only with ntfs3:
    sudo mount -t ntfs3 -o loop,ro wof-poc.img /mnt

  Build the trigger:
    cc -O2 -static wof_offset_table_read_trigger.c -o trigger

  Trigger the bug:
    ./trigger /mnt/poc.bin 0x400000 1

KASAN report on 6.19.10:

  ==================================================================
  BUG: KASAN: slab-out-of-bounds in ntfs_read_write_run+0x321/0x450 [ntfs3]
  Write of size 4096 at addr ffff88800353b000 by task trigger-static/55

  Call Trace:
   __asan_memcpy+0x3c/0x60
   ntfs_read_write_run+0x321/0x450 [ntfs3]
   attr_wof_frame_info+0x52b/0xbc0 [ntfs3]
   ni_read_frame+0x3cc/0xfe0 [ntfs3]
   ni_read_folio_cmpr+0x3b9/0x820 [ntfs3]
   read_pages+0x58a/0x810
   page_cache_ra_unbounded+0x29c/0x5d0
   filemap_get_pages+0x2c8/0x1530
   filemap_read+0x2e7/0xb80
   vfs_read+0x6da/0xa40
   __x64_sys_pread64+0x195/0x250
  ==================================================================

 fs/ntfs3/attrib.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index 6cb9bc5d6..89921e509 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -1576,6 +1576,12 @@ int attr_wof_frame_info(struct ntfs_inode *ni, struct ATTRIB *attr,
 			u64 from = vbo[i] & ~(u64)(PAGE_SIZE - 1);
 			u64 to = min(from + PAGE_SIZE, wof_size);
 
+			if (from >= wof_size) {
+				_ntfs_bad_inode(&ni->vfs_inode);
+				err = -EINVAL;
+				goto out1;
+			}
+
 			err = attr_load_runs_range(ni, ATTR_DATA, WOF_NAME,
 						   ARRAY_SIZE(WOF_NAME), run,
 						   from, to);
-- 
2.50.1 (Apple Git-155)