[PATCH v3] fs/ntfs3: reject invalid evcn == (u64)-1 in mi_enum_attr()

Zhan Xusheng
2026-04-27T03:50:30Z

In mi_enum_attr(), the start/end VCN validation for non-resident
attributes is:
if (svcn > evcn + 1) goto out;

This relies on evcn + 1 arithmetic, which overflows when evcn
is (u64)-1 and wraps to 0, breaking the intended range check.

In that case, malformed on-disk metadata such as:
svcn == 0, evcn == (u64)-1
may incorrectly pass validation.

VCN (virtual cluster number) represents cluster indices within
a NTFS volume and is bounded by the physical size of the filesystem.
Therefore, values near or equal to (u64)-1 are not valid on-disk
VCN values and should be treated as malformed metadata.

Reject this case to prevent arithmetic overflow while preserving
the original semantics of allowing svcn <= evcn + 1.

Fixes: 013ff63b6494 ("fs/ntfs3: Add more attributes checks in mi_enum_attr()")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
fs/ntfs3/record.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 32bdb034c2a3..ad752bebb66c 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -202,7 +202,7 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
u32 used = le32_to_cpu(rec->used);
u32 t32, off, asize, prev_type;
u16 t16;
- u64 data_size, alloc_size, tot_size;
+ u64 svcn, evcn, data_size, alloc_size, tot_size;

if (!attr) {
u32 total = le32_to_cpu(rec->total);
@@ -311,7 +311,10 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
goto out;

/* Check start/end vcn. */
- if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)
+ svcn = le64_to_cpu(attr->nres.svcn);
+ evcn = le64_to_cpu(attr->nres.evcn);
+ /* evcn == (u64)-1 is invalid on-disk VCN */
+ if (evcn == (u64)-1 || svcn > evcn + 1)
goto out;

data_size = le64_to_cpu(attr->nres.data_size);
--
2.43.0