Re: [PATCH v2] ntfs: fix name offset validation in ntfs_non_resident_attr_value_is_valid

[Namjae Jeon]

On Thu, Aug 6, 2026 at 11:39 AM Hongling Zeng <zhongling0719@xxxxxxx> wrote:
>
> Hi:
>
>   Thank you for the review. You're absolutely right on both points:
>
>    1. name_length is u8, not __le16 - my mistake.
>
>    2. Moving the check outside the if (name_length) block is better as
>       it covers both named and unnamed attributes.
>
>    However, I have a concern about using ATTR_COMPRESSION_MASK here.
>
>    In ntfs_attr_update_meta() line 3610, the actual conversion check is:
>
>        if (sparse && !(a->flags & (ATTR_IS_SPARSE | ATTR_IS_COMPRESSED)))
>
>    This uses ATTR_IS_COMPRESSED (0x0001), not ATTR_COMPRESSION_MASK (0x00ff).
>
>    If a malicious MFT record sets flags = 0x0002:
>    - Your check would skip (0x0002 & 0x00ff is true)
>    - But ntfs_attr_update_meta() would still do the forward shift
>      (0x0002 & 0x0001 is false)
>
>    Should we use ATTR_IS_COMPRESSED instead to match the actual conversion
>    predicate? Or is there another reason for the mask that I'm missing?
You're right. Can you send v3 patch after updating it ?
Thanks!