Re: [PATCH] fs/ntfs3: reject evcn == U64_MAX in mi_enum_attr()

David Laight
2026-04-24T09:20:27Z

On Fri, 24 Apr 2026 10:46:19 +0800
Zhan Xusheng <zhanxusheng1024@gmail.com> wrote:

> In mi_enum_attr(), the start/end VCN validation for non-resident
> attributes is:
>
> if (svcn > evcn + 1) goto out;
>
> When on-disk evcn is 0xFFFFFFFFFFFFFFFF (U64_MAX), the addition
> evcn + 1 wraps to 0, and the check becomes "if (svcn > 0)" which
> incorrectly accepts svcn == 0 with evcn == U64_MAX.
>
> mi_enum_attr() is the core attribute iterator used throughout ntfs3.
> Allowing this malformed VCN range to pass the initial validation can
> feed a bogus 64-bit extent span into downstream code that computes
> evcn + 1 - svcn (producing 0 due to wrap) or uses evcn as a loop
> bound.
>
> A crafted NTFS image can trigger this on mount or file access.
>
> Fix by explicitly rejecting evcn == U64_MAX before the addition.
>
> Fixes: 013ff63b6494 ("fs/ntfs3: Add more attributes checks in mi_enum_attr()")
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
> ---
> fs/ntfs3/record.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
> index 32bdb034c2a3..2ff28bfbedad 100644
> --- a/fs/ntfs3/record.c
> +++ b/fs/ntfs3/record.c
> @@ -311,7 +311,8 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
> goto out;
>
> /* Check start/end vcn. */
> - if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)
> + if (le64_to_cpu(attr->nres.evcn) == (u64)-1 ||
> + le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)

Isn't that just:
if (le64_to_cpu(attr->nres.svcn) >= le64_to_cpu(attr->nres.evcn))

David

> goto out;
>
> data_size = le64_to_cpu(attr->nres.data_size);