[PATCH v2] ntfs: reject invalid empty mapping pairs

[PATCH v2] ntfs: reject invalid empty mapping pairs

[Hyunchul Lee]

Reject an attribute with empty mapping pairs if it has inconsistent
highest VCN and size.

Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator")
Reported-by: Robert Morris <rtm@csail.mit.edu>
Closes: https://lore.kernel.org/all/9519.1786907182@localhost/
Cc: stable@vger.kernel.org
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
---
Changes in v2:
  * Restore reloading highest_vcn after mapping-pairs decoding.
  * Add the validation of empty mapping-pairs to accept only
    lowest_vcn == 0 and highest_vcn == -1.

 fs/ntfs/runlist.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/fs/ntfs/runlist.c b/fs/ntfs/runlist.c
index 9eaadbc0ef47..00373e450ea7 100644
--- a/fs/ntfs/runlist.c
+++ b/fs/ntfs/runlist.c
@@ -772,6 +772,25 @@ struct runlist_element *ntfs_mapping_pairs_decompress(const struct ntfs_volume *
 		return ERR_PTR(-EIO);
 	}
 
+	/*
+	 * An empty mapping-pairs array is valid only for a zero-length
+	 * attribute.
+	 */
+	if (!*buf &&
+	    (vcn ||
+	     le64_to_cpu(attr->data.non_resident.highest_vcn) !=
+		     (u64)(vcn - 1) ||
+	     le64_to_cpu(attr->data.non_resident.allocated_size) ||
+	     le64_to_cpu(attr->data.non_resident.data_size) ||
+	     le64_to_cpu(attr->data.non_resident.initialized_size))) {
+		ntfs_error(vol->sb, "Invalid empty mapping pairs array.");
+		return ERR_PTR(-EIO);
+	}
+	if (!vcn && !*buf && old_runlist && old_runlist->rl) {
+		*new_rl_count = old_runlist->count;
+		return old_runlist->rl;
+	}
+
 	/* Current position in runlist array. */
 	rlpos = 0;
 	/* Allocate first page and set current runlist size to one page. */

---
base-commit: df7dce2090342170b7643d36f694204cae7792a9
change-id: 20260819-fix-empty-mp-3f32eb769112

Best regards,
-- 
Thanks,
Hyunchul