fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass

In log_replay()'s analysis pass, after find_dp() returns a
valid DIR_PAGE_ENTRY for the (target_attr, target_vcn) tuple,
the copy_lcns block walks lrh->lcns_follow further entries:

	t16 = le16_to_cpu(lrh->lcns_follow);
	for (i = 0; i < t16; i++) {
	    size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
	                        le64_to_cpu(dp->vcn));
	    dp->page_lcns[j + i] = lrh->page_lcns[i];
	}

find_dp() only validates that target_vcn falls within
[dp->vcn, dp->vcn + dp->lcns_follow), i.e., that the FIRST
cluster is covered.  The walk through the further entries is
not bounded against dp->lcns_follow.  For a malformed LRH
where target_vcn = dp->vcn + dp->lcns_follow - 1 and
lrh->lcns_follow > 1, the i > 0 writes overflow the dp's
allocated page_lcns[] array.

Add the missing j + lrh->lcns_follow <= dp->lcns_follow guard.

Reproduced under UML+KASAN on mainline 8d90b09e6741 as a
slab-out-of-bounds write of size 8 from log_replay+0x68d4 on
the mount path.

This is distinct from Pavitra Jha's 2026-05-02 patch
("fs/ntfs3: validate lcns_follow in log_replay conversion",
<20260502154252.164586-1-jhapavitra98@gmail.com>) which
addresses the separate version-0 dirty-page-table conversion
path's memmove(&dp->vcn, ...) call.  The two fixes are
complementary; both should land.

Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
[almaz.alexandrovich@paragon-software.com: clang-formatted the changes,
fixed conflicts]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 2bd8754ef26d09cdc38788cef02e62ee64d71fda..81a305d4bcf2681c4a708efd8df87385b9473a45 100644 (file)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -3394,8 +3394,8 @@ move_data:
 
                if (run_get_highest_vcn(le64_to_cpu(attr->nres.svcn),
                                        attr_run(attr),
-                                       le32_to_cpu(attr->size) - 
-                                               le16_to_cpu(attr->nres.run_off),        
+                                       le32_to_cpu(attr->size) -
+                                               le16_to_cpu(attr->nres.run_off),
                                        &t64)) {
                        goto dirty_vol;
                }
@@ -4585,22 +4585,34 @@ copy_lcns:
                 * whole routine a loop, case Lcns do not fit below.
                 */
                t16 = le16_to_cpu(lrh->lcns_follow);
-                t32 = le32_to_cpu(dp->lcns_follow);
-                if (le64_to_cpu(lrh->target_vcn) < le64_to_cpu(dp->vcn)) {
-                        err = -EINVAL;
-                        goto out;
-                }
-
-                for (i = 0; i < t16; i++) {
-                        size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
-                                            le64_to_cpu(dp->vcn));
-                        if (j >= t32 || i >= t32 - j) {
-                                err = -EINVAL;
-                                goto out;
-                        }
-                        dp->page_lcns[j + i] = lrh->page_lcns[i];
-                }
+               t32 = le32_to_cpu(dp->lcns_follow);
+               if (le64_to_cpu(lrh->target_vcn) < le64_to_cpu(dp->vcn)) {
+                       err = -EINVAL;
+                       goto out;
+               }
+
+               /*
+         * find_dp() only validates that target_vcn is the first
+         * cluster covered by dp.  The walk through lrh->lcns_follow
+         * further entries must stay within the allocated
+         * dp->page_lcns[] array, which is sized by dp->lcns_follow.
+         */
+               if (le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn) + t16 >
+                   le32_to_cpu(dp->lcns_follow)) {
+                       err = -EINVAL;
+                       log->set_dirty = true;
+                       goto out;
+               }
 
+               for (i = 0; i < t16; i++) {
+                       size_t j = (size_t)(le64_to_cpu(lrh->target_vcn) -
+                                           le64_to_cpu(dp->vcn));
+                       if (j >= t32 || i >= t32 - j) {
+                               err = -EINVAL;
+                               goto out;
+                       }
+                       dp->page_lcns[j + i] = lrh->page_lcns[i];
+               }
                goto next_log_record_analyze;
 
        case DeleteDirtyClusters: {