[PATCH v4] fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

[PATCH v4] fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

[fra-build]

From: Zhan Xusheng <zhanxusheng@xiaomi.com>

In mi_enum_attr(), the start/end VCN validation for non-resident
attributes is:

	if (svcn > evcn + 1) goto out;

When evcn is U64_MAX the "evcn + 1" expression wraps to 0 and any
svcn passes the check.  For evcn values close to U64_MAX (but not
equal to it) the right-hand side is still a meaningless near-wrap
upper bound, so a malformed on-disk attribute with svcn == 0 and
evcn near U64_MAX can pass mi_enum_attr() unrejected.

VCN (virtual cluster number) is a cluster index, so any valid evcn
is bounded by the volume's total cluster count, which ntfs3 holds
in sbi->used.bitmap.nbits (set up in ntfs_init_from_boot() before
any caller of mi_enum_attr() runs).  Reject evcn values that fall
outside this range; this rejects all out-of-range evcn values,
not just U64_MAX, and as a side effect prevents the "evcn + 1"
wraparound entirely.

Fixes: 013ff63b6494 ("fs/ntfs3: Add more attributes checks in mi_enum_attr()")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
 fs/ntfs3/record.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 32bdb034c2a3..4379446bcf96 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -202,7 +202,7 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
 	u32 used = le32_to_cpu(rec->used);
 	u32 t32, off, asize, prev_type;
 	u16 t16;
-	u64 data_size, alloc_size, tot_size;
+	u64 svcn, evcn, data_size, alloc_size, tot_size;
 
 	if (!attr) {
 		u32 total = le32_to_cpu(rec->total);
@@ -310,8 +310,17 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
 	if (t32 && le16_to_cpu(attr->name_off) + t32 > t16)
 		goto out;
 
-	/* Check start/end vcn. */
-	if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)
+	/*
+	 * Check start/end vcn.  evcn must be a valid cluster index, i.e.
+	 * less than the volume's total cluster count (sbi->used.bitmap.nbits);
+	 * rejecting it here also keeps "svcn > evcn + 1" meaningful, since
+	 * evcn == U64_MAX would wrap "evcn + 1" to 0.  svcn does not need
+	 * its own bound: once evcn < nbits, "svcn > evcn + 1" implies
+	 * svcn <= nbits.
+	 */
+	svcn = le64_to_cpu(attr->nres.svcn);
+	evcn = le64_to_cpu(attr->nres.evcn);
+	if (evcn >= mi->sbi->used.bitmap.nbits || svcn > evcn + 1)
 		goto out;
 
 	data_size = le64_to_cpu(attr->nres.data_size);
-- 
2.43.0

Re: [PATCH v4] fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

[David Laight]

On Fri, 15 May 2026 16:23:05 +0800
fra-build <zhanxusheng1024@gmail.com> wrote:

> From: Zhan Xusheng <zhanxusheng@xiaomi.com>
> 
> In mi_enum_attr(), the start/end VCN validation for non-resident
> attributes is:
> 
> 	if (svcn > evcn + 1) goto out;
> 
> When evcn is U64_MAX the "evcn + 1" expression wraps to 0 and any
> svcn passes the check.  For evcn values close to U64_MAX (but not
> equal to it) the right-hand side is still a meaningless near-wrap
> upper bound, so a malformed on-disk attribute with svcn == 0 and
> evcn near U64_MAX can pass mi_enum_attr() unrejected.
> 
> VCN (virtual cluster number) is a cluster index, so any valid evcn
> is bounded by the volume's total cluster count, which ntfs3 holds
> in sbi->used.bitmap.nbits (set up in ntfs_init_from_boot() before
> any caller of mi_enum_attr() runs).  Reject evcn values that fall
> outside this range; this rejects all out-of-range evcn values,
> not just U64_MAX, and as a side effect prevents the "evcn + 1"
> wraparound entirely.
> 
> Fixes: 013ff63b6494 ("fs/ntfs3: Add more attributes checks in mi_enum_attr()")
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>

Reviewed-by: David Laight <david.laight.linux@gmail.com>

> ---
>  fs/ntfs3/record.c | 15 ++++++++++++---
>  1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
> index 32bdb034c2a3..4379446bcf96 100644
> --- a/fs/ntfs3/record.c
> +++ b/fs/ntfs3/record.c
> @@ -202,7 +202,7 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
>  	u32 used = le32_to_cpu(rec->used);
>  	u32 t32, off, asize, prev_type;
>  	u16 t16;
> -	u64 data_size, alloc_size, tot_size;
> +	u64 svcn, evcn, data_size, alloc_size, tot_size;
>  
>  	if (!attr) {
>  		u32 total = le32_to_cpu(rec->total);
> @@ -310,8 +310,17 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
>  	if (t32 && le16_to_cpu(attr->name_off) + t32 > t16)
>  		goto out;
>  
> -	/* Check start/end vcn. */
> -	if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)
> +	/*
> +	 * Check start/end vcn.  evcn must be a valid cluster index, i.e.
> +	 * less than the volume's total cluster count (sbi->used.bitmap.nbits);
> +	 * rejecting it here also keeps "svcn > evcn + 1" meaningful, since
> +	 * evcn == U64_MAX would wrap "evcn + 1" to 0.  svcn does not need
> +	 * its own bound: once evcn < nbits, "svcn > evcn + 1" implies
> +	 * svcn <= nbits.
> +	 */
> +	svcn = le64_to_cpu(attr->nres.svcn);
> +	evcn = le64_to_cpu(attr->nres.evcn);
> +	if (evcn >= mi->sbi->used.bitmap.nbits || svcn > evcn + 1)
>  		goto out;
>  
>  	data_size = le64_to_cpu(attr->nres.data_size);