From nobody Wed Jun 17 07:22:47 2026 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1291B363095 for ; Mon, 27 Apr 2026 03:47:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777261660; cv=none; b=EyIpNNYoHz7b47w89NOkmv/xt7oBTHTh8f3M6eDsncdhppOb7cAJJpPl7uid6bIUMnwwnCGc9rC/vW7bqVNNV8nIljDMhHXDw8uuX37jBt6awtSYKWDXU0I+cQt6zhumODMiwhutrPMLGZqeUH1BLpDZxnsmhZx4wyUz7b20Wcs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777261660; c=relaxed/simple; bh=UcQ+Ia0PLtka5ONr65AtIknvE0yeUBMwuQBj2YcvYwA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=L+Aj7p60Lk40QPgYinye4xJcc2JxqlGnkA0NiPSfIANqE9/IAs3YPriyOCGoItpgvSfLXhq+Nun0B8o8IQwXfUa0EteB7Yp0dUdzR/Djfg3Dk4zWRRdSZuQOzoeM8lfxEFzQ+WGdvOZ1EnQ3YWGR03tjszKSGmPsD1iMX3JyTrQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VajwB5Vd; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VajwB5Vd" Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-3614826eca4so8569389a91.1 for ; Sun, 26 Apr 2026 20:47:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777261658; x=1777866458; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=SITHK9cFEZ3EPl8tO8lZTNnorh5KMZPHbK8HM1ECYfQ=; b=VajwB5VdJqscoxaMDwEOykmZYNZSyyF1lz46r6EhehftYXzUBxYNOx8xMzf5XLfqrE sKEExYx/AOTcsOy/o6yeP698vx18AJ2uG+LD5CHf9UlBRFNIhetdNgw58givxwJn+uYz e+g3LCK6QsLLU/Y5KjVwIV/9PuAl/xcOHkW+8r1jiP5dDYIj4I0P2cWmpEyDB36ZecZc EiaHVlYzyAMpuZyzBPOVb4gCZOsflj9gy/RH7wlGzwrVTqSUYrh/Bg8T1FiMoJrQzS0d ML3/fEYh4OzyaNNPl8M6sFZ4b32txhI69rL4GlWxf37WPUd+Cnas0IRCtHa/FB4uNuMN dvIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777261658; x=1777866458; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=SITHK9cFEZ3EPl8tO8lZTNnorh5KMZPHbK8HM1ECYfQ=; b=A2DMnx3u1rirECST0r8Jyr3boGBi0zJkXqQ/m6Z6M6D525CH71hTVPN6zVoCy9swQ7 3AC9fRs5sfqvGxL3f2tq8gm6/LcTitrKPdGgT8fBT/hgM/TVjxr9zE/aBobzeT09RJON RPHY7emqYf2j5n3yQEQSItrk+XtGd+tEmMJOVoTsUzWECw0PLbtkc5sr6cX68x0UkGGA zvNGg5N5CF3sBtQIKUSxCZuRrKj2QtIwhnwiYzxkeazYdfZlP/Geq2hJDQAQX88gQntR fiaSAFutjLL2GDcgf3iJcqMHTReYQ/v9w+CECc6pp6mZNvjJNzYmW2n8byxiuFk8bCqN VWOA== X-Forwarded-Encrypted: i=1; AFNElJ86D3YbHWJxn/BaVDSvtFz4byigzg/dfkFAIjyXqRUkJFMA0YQNhmra7KddHe9Y/gVn2Crk0mzzOKHZ0uA=@vger.kernel.org X-Gm-Message-State: AOJu0Yz0l0gbNPj6vaFCnnuXDqzL9XsC2sLeUnLtifFAxBDDgvNr1GcD JK8bAWLVA53r5HXf0pjlCRm+YW3CDPAwdnT4XQjp6jcCPtOHthVNA5Hi X-Gm-Gg: AeBDieuA5rqWIkUTkjTgG0DrfzZAZU/O/fV7ijBJYZmzkcXBoSU9GTbKGESihEnB2Fk OSsb97NeTUQhlx0AgJlVThBeuMH69BD8kvXacCcHYoKHBLy4fa1w93NhU7LaFo/UnOx8sPtko+a DH0qUYm7wrs5OaX6yWyp0lkZRsX5Y3+gLrX9KJdRq7CUb1EWw860kEauPS7UW3mH4Clv+DgIO4b xutFIypZ72eCFaUQX5W06TSq7t1XIcNiLdq/sETEMUOlAT2QLrFFJu8g6WzSmPK2CetP7iQsgaW Dc+ogyZdrUhT1fDn9DEe6gOzNJWdobivIiaeFWZd8uYUZC0HpMUffi8p/6HoYABbkRLfhhPKb/A JLUEwGGhFHK5cZYA/0RavYEE5o1HdV84PHCsteE3kE9MLCa/rQ2o9T/Skyo368r0r15eUmrolrX A9LKDqVeUki/wIMhuKamTtLGRhhJXMfArbC/aQYSoDT8hx0060u3BnjB9mkJKNHhc92MnB X-Received: by 2002:a17:90b:4fcc:b0:35f:b293:7ac6 with SMTP id 98e67ed59e1d1-361403bd8camr44494954a91.6.1777261658452; Sun, 26 Apr 2026 20:47:38 -0700 (PDT) Received: from DESKTOP-MOQC9AF.mioffice.cn ([43.224.245.246]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3613fb42e25sm14697448a91.3.2026.04.26.20.47.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 26 Apr 2026 20:47:37 -0700 (PDT) From: Zhan Xusheng X-Google-Original-From: Zhan Xusheng To: David Laight Cc: Konstantin Komarov , linux-kernel@vger.kernel.org, Zhan Xusheng Subject: [PATCH v2] fs/ntfs3: reject invalid evcn == (u64)-1 in mi_enum_attr() Date: Mon, 27 Apr 2026 11:47:30 +0800 Message-ID: <20260427034730.38012-1-zhanxusheng@xiaomi.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260425114246.545866b6@pumpkin> References: <20260425114246.545866b6@pumpkin> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In mi_enum_attr(), the start/end VCN validation for non-resident attributes is: if (svcn > evcn + 1) goto out; This relies on evcn + 1 arithmetic, which overflows when evcn is (u64)-1 and wraps to 0, breaking the intended range check. In that case, malformed on-disk metadata such as: svcn =3D=3D 0, evcn =3D=3D (u64)-1 may incorrectly pass validation. VCN (virtual cluster number) represents cluster indices within a NTFS volume and is bounded by the physical size of the filesystem. Therefore, values near or equal to (u64)-1 are not valid on-disk VCN values and should be treated as malformed metadata. Reject this case to prevent arithmetic overflow while preserving the original semantics of allowing svcn <=3D evcn + 1. Fixes: 013ff63b6494 ("fs/ntfs3: Add more attributes checks in mi_enum_attr(= )") Signed-off-by: Zhan Xusheng --- fs/ntfs3/record.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c index 32bdb034c2a3..ad752bebb66c 100644 --- a/fs/ntfs3/record.c +++ b/fs/ntfs3/record.c @@ -202,7 +202,7 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, stru= ct mft_inode *mi, u32 used =3D le32_to_cpu(rec->used); u32 t32, off, asize, prev_type; u16 t16; - u64 data_size, alloc_size, tot_size; + u64 svcn, evcn, data_size, alloc_size, tot_size; =20 if (!attr) { u32 total =3D le32_to_cpu(rec->total); @@ -311,7 +311,10 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, str= uct mft_inode *mi, goto out; =20 /* Check start/end vcn. */ - if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1) + svcn =3D le64_to_cpu(attr->nres.svcn); + evcn =3D le64_to_cpu(attr->nres.evcn); + /* evcn =3D=3D (u64)-1 is invalid on-disk VCN */ + if (evcn =3D=3D (u64)-1 || svcn > evcn + 1) goto out; =20 data_size =3D le64_to_cpu(attr->nres.data_size); --=20 2.43.0