Re: [PATCH] fs/ntfs3: reject evcn == U64_MAX in mi_enum_attr()

[David Laight]

On Fri, 24 Apr 2026 10:46:19 +0800
Zhan Xusheng <zhanxusheng1024@xxxxxxxxx> wrote:

> In mi_enum_attr(), the start/end VCN validation for non-resident
> attributes is:
> 
>     if (svcn > evcn + 1) goto out;
> 
> When on-disk evcn is 0xFFFFFFFFFFFFFFFF (U64_MAX), the addition
> evcn + 1 wraps to 0, and the check becomes "if (svcn > 0)" which
> incorrectly accepts svcn == 0 with evcn == U64_MAX.
> 
> mi_enum_attr() is the core attribute iterator used throughout ntfs3.
> Allowing this malformed VCN range to pass the initial validation can
> feed a bogus 64-bit extent span into downstream code that computes
> evcn + 1 - svcn (producing 0 due to wrap) or uses evcn as a loop
> bound.
> 
> A crafted NTFS image can trigger this on mount or file access.
> 
> Fix by explicitly rejecting evcn == U64_MAX before the addition.
> 
> Fixes: 013ff63b6494 ("fs/ntfs3: Add more attributes checks in mi_enum_attr()")
> Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
> ---
>  fs/ntfs3/record.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
> index 32bdb034c2a3..2ff28bfbedad 100644
> --- a/fs/ntfs3/record.c
> +++ b/fs/ntfs3/record.c
> @@ -311,7 +311,8 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
>  		goto out;
>  
>  	/* Check start/end vcn. */
> -	if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)
> +	if (le64_to_cpu(attr->nres.evcn) == (u64)-1 ||
> +	    le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)

Isn't that just:
	if (le64_to_cpu(attr->nres.svcn) >= le64_to_cpu(attr->nres.evcn))

	David

>  		goto out;
>  
>  	data_size = le64_to_cpu(attr->nres.data_size);