Re: [PATCH] ntfs: widen the sub-block offsets in ntfs_decompress()

[Namjae Jeon]

On Fri, Oct 9, 2026 at 4:55 PM Zhan Xusheng <zhanxusheng1024@xxxxxxxxx> wrote:
>
> ntfs_decompress() tracks where the current sub-block starts and ends
> inside the destination page with two u16s:
>
>         u16 do_sb_start;
>         u16 do_sb_end;
>         ...
>         do_sb_start = *dest_ofs;
>         do_sb_end = do_sb_start + NTFS_SB_SIZE;
>
> *dest_ofs is an int page offset masked with ~PAGE_MASK, and
> NTFS_SB_SIZE is 0x1000, so do_sb_end needs PAGE_SIZE + 0xfff of range.
> That exceeds u16 once PAGE_SIZE reaches 0x10000: the last sub-block of a
> page starts at 0xf000 and do_sb_end wraps from 0x10000 to 0.
>
> The zero-fill that pads a short sub-block then computes a negative
> length:
>
>         if (dp_addr < dp_sb_end) {
>                 int nr_bytes = do_sb_end - *dest_ofs;
>
>                 memset(dp_addr, 0, nr_bytes);
>
> A sub-block made only of symbol tokens reaches this without consulting
> do_sb_end on the way, because that path just does
>
>         *dp_addr++ = *cb++;
>         ++*dest_ofs;
>
> and is bounded by dp_addr against dp_sb_end.  With do_sb_start at 0xf000
> and eight literal bytes emitted, nr_bytes is -61448 and the memset()
> runs for 18446744073709490168 bytes.
>
> Getting there is cheap: fifteen sub-blocks of eleven bytes each advance
> *dest_ofs to 0xf000, since the same zero-fill pads each of them out to
> 0x1000 while do_sb_end is still exact, and the sixteenth one triggers
> the wrap.  A compression block is 0x10000 bytes with 4 KiB clusters and
> the fixed compression unit of 4, so all sixteen fit with room to spare.
>
> Phrase tokens are bounded against do_sb_end and so return -EOVERFLOW
> instead, and the
>
>         if (*dest_index == dest_max_index && do_sb_end > dest_max_ofs)
>
> check at the top of the sub-block stops firing for the same reason.
>
> Use int for both, matching *dest_ofs and dest_max_ofs.  The narrow type
> came in with the original import and survived the removal and revert of
> the driver.
>
> Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
> Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
Applied it to #ntfs-next.
Thanks!