Re: [PATCH v2 0/3] ntfs: harden MFT record and attribute parsing

[Namjae Jeon]

On Sat, May 9, 2026 at 3:12 PM DaeMyung Kang <charsyam@xxxxxxxxx> wrote:
>
> This series tightens fs/ntfs against malformed on-disk metadata and
> fixes one off-by-one in the MFT bitmap scan.
>
> Patches 1/3 and 3/3 are complementary: 1/3 rejects MFT records whose
> attrs_offset points past bytes_in_use at record entry, and 3/3 moves
> the per-attribute name bounds check earlier so it covers the AT_UNUSED
> enumeration path that hands the name pointer back to callers.  Without
> 3/3, two enumeration paths can read past an attribute record: one in
> fs/ntfs/attrib.c passes the returned name pointer to ntfs_attr_iget(),
> and another in fs/ntfs/inode.c copies the name while building an
> attribute list.
>
> Patch 2/3 is independent: ntfs_mft_record_layout() rejects
> mft_no >= 2^32, but the bitmap scan in
> ntfs_mft_bitmap_find_and_alloc_free_rec_nolock() used '>'.  Bring it in
> line with the other 2^32 boundary checks in fs/ntfs/mft.c.
>
> All three carry the same upstream Fixes tag (1da177e4c3f4) since the
> issues date from the initial upstream import of fs/ntfs.
>
> Changes since v1:
>   - All patches: replaced the OOT Fixes tag d3ad708fecaa ("ntfs:
>     Initial commit") with the upstream commit 1da177e4c3f4
>     ("Linux-2.6.12-rc2"), since checkpatch flagged the v1 commit id
>     as unknown to mainline and all three issues date from the initial
>     fs/ntfs import.
>   - 2/3: removed the OOT-only "#if LINUX_VERSION_CODE >= KERNEL_VERSION(
>     6, 6, 0)" guard that surrounded the folio_unlock()/kunmap_local()/
>     folio_put() block; mainline does not need it and it prevented the
>     patch from applying.
>   - 1/3, 3/3: no functional change.
>
> v1: https://lore.kernel.org/linux-ntfs/20260508153410.2624801-1-charsyam@xxxxxxxxx/
>
> DaeMyung Kang (3):
>   ntfs: validate MFT attrs_offset against bytes_in_use
>   ntfs: fix MFT bitmap scan 2^32 boundary check
>   ntfs: validate attribute name bounds before returning it
Applied them to #ntfs-next.
Thanks!