[PATCH] fs/ntfs3: reject evcn == U64_MAX in mi_enum_attr()

[Zhan Xusheng]

In mi_enum_attr(), the start/end VCN validation for non-resident
attributes is:

    if (svcn > evcn + 1) goto out;

When on-disk evcn is 0xFFFFFFFFFFFFFFFF (U64_MAX), the addition
evcn + 1 wraps to 0, and the check becomes "if (svcn > 0)" which
incorrectly accepts svcn == 0 with evcn == U64_MAX.

mi_enum_attr() is the core attribute iterator used throughout ntfs3.
Allowing this malformed VCN range to pass the initial validation can
feed a bogus 64-bit extent span into downstream code that computes
evcn + 1 - svcn (producing 0 due to wrap) or uses evcn as a loop
bound.

A crafted NTFS image can trigger this on mount or file access.

Fix by explicitly rejecting evcn == U64_MAX before the addition.

Fixes: 013ff63b6494 ("fs/ntfs3: Add more attributes checks in mi_enum_attr()")
Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
---
 fs/ntfs3/record.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index 32bdb034c2a3..2ff28bfbedad 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -311,7 +311,8 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
 		goto out;
 
 	/* Check start/end vcn. */
-	if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)
+	if (le64_to_cpu(attr->nres.evcn) == (u64)-1 ||
+	    le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)
 		goto out;
 
 	data_size = le64_to_cpu(attr->nres.data_size);
-- 
2.43.0