Re: [PATCH v2] fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

Hi Konstantin,

Gentle ping on this v2. It's an attacker-controlled on-disk image heap
out-of-bounds write in ni_create_attr_list(),
reachable via setxattr on a crafted, loop-mounted NTFS image (KASAN
trace is in the commit message), which is why it's Cc'd to stable.

For the record, the fix was first posted as v1 on 2026-06-10:
https://lore.kernel.org/ntfs3/[email protected]/
This v2 (2026-06-25) only adds Cc: stable and widens review to
linux-fsdevel; the fix itself is unchanged from v1.

Could you let me know if you'd like any changes, or whether it can be
queued for a future bugfix pull? I'm happy to rebase or adjust as
needed.

Thanks,
HE WEI (=E3=82=AE=E3=82=AB=E3=82=AF)

hewei-gikaku <[email protected]> =E4=BA=8E2026=E5=B9=B46=E6=9C=8825=E6=97=
=A5=E5=91=A8=E5=9B=9B 12:19=E5=86=99=E9=81=93=EF=BC=9A
>
> From: HE WEI (=E3=82=AE=E3=82=AB=E3=82=AF) <[email protected]>
>
> ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size)
> (=3D=3D record_size) bytes and then walks every attribute of the primary =
MFT
> record, writing one ATTR_LIST_ENTRY per attribute and advancing the curso=
r
> by le_size(name_len), with no check against the end of the buffer; the
> total size is only computed after the loop.
>
> A minimum-size resident attribute occupies SIZEOF_RESIDENT (0x18 =3D 24)
> bytes on disk, but an unnamed attribute expands to le_size(0) (0x20 =3D 3=
2)
> bytes in the list.  Because the number of attributes in a record is not
> bounded (mi_enum_attr() accepts arbitrarily many equal-type, nameless
> minimum-size attributes), a crafted record packed with such attributes
> produces a list larger than record_size and overflows the heap buffer.
>
> This is reachable from a crafted, loop-mounted NTFS image: opening the fi=
le
> and adding an attribute (e.g. via setxattr) drives ntfs_set_ea() ->
> ni_insert_resident() -> ni_insert_attr() -> ni_ins_attr_ext() ->
> ni_create_attr_list().
>
>   BUG: KASAN: slab-out-of-bounds in ni_create_attr_list+0xc48/0x1058
>   Write of size 4 at addr ffff000008984c00 by task setfattr/345
>    ni_create_attr_list+0xc48/0x1058
>    ni_ins_attr_ext+0x510/0x7c0
>    ni_insert_attr+0x3f8/0x70c
>    ni_insert_resident+0xc8/0x3b0
>    ntfs_set_ea+0x66c/0xd28
>    ntfs_setxattr+0x4d8/0x5b0
>    __arm64_sys_setxattr+0xa4/0x124
>   Allocated by task 345:
>    ni_create_attr_list+0x188/0x1058
>   The buggy address belongs to the cache kmalloc-1k of size 1024
>   (the write lands at object+1024).
>
> Size the buffer from the actual attributes instead of assuming a single
> record_size is always enough.
>
> Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
> Cc: [email protected]
> Signed-off-by: HE WEI (=E3=82=AE=E3=82=AB=E3=82=AF) <[email protected]>
> ---
> v2:
>  - Add Cc: [email protected]: this is an attacker-controlled on-disk
>    image heap out-of-bounds write and should be backported.
>  - No functional change from v1; widening Cc (linux-fsdevel, VFS) for
>    review, as the v1 posting received no response.
>  - Drop a redundant self Reported-by.
>
> v1: https://lore.kernel.org/all/[email protected]=
/
> ---
>  fs/ntfs3/frecord.c | 20 ++++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)
>
> diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
> index 2e901d073fe9..6488d7a415c0 100644
> --- a/fs/ntfs3/frecord.c
> +++ b/fs/ntfs3/frecord.c
> @@ -768,10 +768,23 @@ int ni_create_attr_list(struct ntfs_inode *ni)
>         rs =3D sbi->record_size;
>
>         /*
> -        * Skip estimating exact memory requirement.
> -        * Looks like one record_size is always enough.
> +        * Compute the exact size of the attribute list.  Each attribute =
in the
> +        * record yields one ATTR_LIST_ENTRY of le_size(name_len) bytes. =
 The
> +        * minimum on-disk attribute is SIZEOF_RESIDENT (0x18) bytes, but=
 an
> +        * unnamed one expands to le_size(0) (0x20) here, so a record cra=
fted
> +        * with many such attributes needs more than a single record_size=
; the
> +        * previous fixed kzalloc(record_size) could therefore be overflo=
wed by
> +        * an attacker-controlled record.
>          */
> -       le =3D kzalloc(al_aligned(rs), GFP_NOFS);
> +       lsize =3D 0;
> +       attr =3D NULL;
> +       while ((attr =3D mi_enum_attr(ni, &ni->mi, attr)))
> +               lsize +=3D le_size(attr->name_len);
> +
> +       if (!lsize)
> +               return -EINVAL;
> +
> +       le =3D kzalloc(al_aligned(lsize), GFP_NOFS);
>         if (!le)
>                 return -ENOMEM;
>
> @@ -781,7 +794,6 @@ int ni_create_attr_list(struct ntfs_inode *ni)
>         attr =3D NULL;
>         nb =3D 0;
>         free_b =3D 0;
> -       attr =3D NULL;
>
>         for (; (attr =3D mi_enum_attr(ni, &ni->mi, attr)); le =3D Add2Ptr=
(le, sz)) {
>                 sz =3D le_size(attr->name_len);
> --
> 2.43.0