DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 60C74606A31A
To: Namjae Jeon <linkinjeon@kernel.org>,
    Hyunchul Lee <hyc.lee@gmail.com>
cc: ntfs@lists.linux.dev
From: rtm@csail.mit.edu
Reply-To: rtm@csail.mit.edu
Subject: ntfs_resident_attr_value_resize() uses value_offset w/o check
Date: Sat, 31 Oct 2026 16:40:34 -0400
Message-ID: <72452.1793479234@localhost>
Precedence: list

In ntfs/attrib.c's ntfs_resident_attr_value_resize():

        old_size = le32_to_cpu(a->data.resident.value_length);
        if (new_size > old_size)
                memset((u8 *)a + le16_to_cpu(a->data.resident.value_offset) +
                                old_size, 0, new_size - old_size);

A corrupt NTFS image could have value_offset greater than the
attribute length, so that memset() zeros outside of the allocated
memory.

A demo:

# wget http://www.rtmrtm.org/rtm/ntfs40e.img.gz
# gunzip ntfs40e.img.gz
# cp ntfs40e.img junk
# mount -t ntfs -o loop,rw junk /mnt
# echo b >> /mnt/a

You'll need to add a printk to ntfs_resident_attr_value_resize() to
see the problem (unless you get lucky and the memset() disturbs some
critical kernel data).

(gdb) where
#0  ntfs_resident_attr_value_resize (m=<optimized out>, a=0xffffffd6059ce548, 
    new_size=new_size@entry=4) at fs/ntfs/attrib.c:1982
#1  0xffffffff804c0ab0 in ntfs_resident_attr_resize (
    attr_ni=attr_ni@entry=0xffffffd603ded000, newsize=newsize@entry=4, 
    prealloc_size=prealloc_size@entry=0, holes=1) at fs/ntfs/attrib.c:4918
#2  0xffffffff804c1814 in ntfs_attr_expand_locked (
    ni=ni@entry=0xffffffd603ded000, newsize=newsize@entry=4, 
    prealloc_size=prealloc_size@entry=0, locked_ni=locked_ni@entry=0x0)
    at fs/ntfs/attrib.c:5207
#3  0xffffffff804c18c0 in ntfs_attr_expand (ni=ni@entry=0xffffffd603ded000, 
    newsize=newsize@entry=4, prealloc_size=prealloc_size@entry=0)
    at fs/ntfs/attrib.c:5224
#4  0xffffffff804c786a in ntfs_expand_for_write (end=4, ni=0xffffffd603ded000)
    at fs/ntfs/file.c:850
#5  ntfs_file_write_iter (iocb=0xffffffc600253dc8, from=0xffffffc600253da0)
    at fs/ntfs/file.c:923
#6  0xffffffff803031d2 in new_sync_write (ppos=0xffffffc600253e40, len=2, 
    buf=0x2aaaae3620 <error: Cannot access memory at address 0x2aaaae3620>, 
    filp=0xffffffd6049351c0) at fs/read_write.c:595
#7  vfs_write (file=file@entry=0xffffffd6049351c0, 
    buf=buf@entry=0x2aaaae3620 <error: Cannot access memory at address 0x2aaaae3620>, count=count@entry=2, pos=pos@entry=0xffffffc600253e40)
    at fs/read_write.c:687
#8  0xffffffff803035fa in ksys_write (fd=<optimized out>, 
    buf=0x2aaaae3620 <error: Cannot access memory at address 0x2aaaae3620>, 
    count=2) at fs/read_write.c:739
#9  0xffffffff80303678 in __do_sys_write (count=<optimized out>, 
    buf=<optimized out>, fd=<optimized out>) at fs/read_write.c:750
#10 __se_sys_write (count=<optimized out>, buf=<optimized out>, 
    fd=<optimized out>) at fs/read_write.c:747
#11 __riscv_sys_write (regs=<optimized out>) at fs/read_write.c:747
#12 0xffffffff80ebc0ce in syscall_handler (syscall=<optimized out>, 
    regs=0xffffffc600253ee0) at ./arch/riscv/include/asm/syscall.h:112
(gdb) print old_size
$1 = 3
(gdb) print new_size
$2 = 4
(gdb) print *a
$3 = {type = 128, length = 8, non_resident = 255 '\377', 
  name_length = 255 '\377', name_offset = 65535, flags = 0, instance = 0, 
  data = {resident = {value_length = 3, value_offset = 48925, 
      flags = 0 '\000', reserved = 0 '\000'}, non_resident = {
      lowest_vcn = 210131274956803, highest_vcn = 4294904417, 
      mapping_pairs_offset = 65535, compression_unit = 255 '\377', 
      reserved = "\377\000\000\000", allocated_size = 210131274956803, 
      data_size = 0, initialized_size = 0, compressed_size = 0}}}

Robert Morris
rtm@mit.edu