[PATCH] fs/ntfs3: fix Out-Of-Bounds write in log_replay() via unvalidated data_off

Pavitra Jha
2026-05-02T10:50:30Z

log_replay() applies UpdateRecordDataRoot and UpdateRecordDataAllocation
redo operations using a destination pointer derived from the on-disk field
e->view.data_off, which is a 16-bit value read from attacker-controlled
filesystem data:

memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);

Neither check_if_index_root() nor check_if_root_index() validate
data_off against e->size. A crafted NTFS image can set data_off to
0xFFFF, causing memmove() to write attacker-controlled data out of
bounds of the NTFS_DE entry and its backing allocation.

The same unvalidated pattern exists in UpdateRecordDataAllocation.

ntfs3_bad_de_range() already exists to validate data_off and dlen
against e->size. Call it before each memmove(), bailing to dirty_vol on
violation. This mirrors the fix applied to DeleteIndexEntryRoot in
commit b2bc7c44ed17
("fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot").

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Signed-off-by: Pavitra Jha <jhapavitra98@gmail.com>
---
fs/ntfs3/fslog.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 272e45276..c0237f7d0 100644
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3487,6 +3487,9 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,

e = Add2Ptr(attr, le16_to_cpu(lrh->attr_off));

+ if (ntfs3_bad_de_range(e, dlen))
+ goto dirty_vol;
+
memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);

mi->dirty = true;
@@ -3679,6 +3682,9 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe,
goto dirty_vol;
}

+ if (ntfs3_bad_de_range(e, dlen))
+ goto dirty_vol;
+
memmove(Add2Ptr(e, le16_to_cpu(e->view.data_off)), data, dlen);

a_dirty = true;
--
2.53.0