Re: [PATCH] fs/ntfs: Fix min_len for compressed/sparse attributes in ntfs_non_resident_attr_value_is_valid()

[Namjae Jeon]

On Tue, Jul 14, 2026 at 11:52 PM Alexandro Calò
<alexandro.calo@xxxxxxxxxxxxxxxxxx> wrote:
>
> From: Alexandro Calo <alexandro.calo@xxxxxxxxxxxxxxxxxx>
> Date: Tue, 14 Jul 2026 16:13:51 +0200
> Subject: [PATCH] fs/ntfs: Fix min_len for compressed/sparse attributes in ntfs_non_resident_attr_value_is_valid()
>
> Here the attribute validator computes a single min_len = 64 (as the end of
> initialized_size) for all non-resident attributes regardless of the flags
> field. This is correct for regular non-resident attributes but for sparse
> or compressed non-resident attributes the fixed header is 8 bytes longer,
> it includes a compressed_size field at bytes 64-71, min_len should be 72.
>
> Since the validator lets a sparse/compressed attr_record be less than the
> correct lenght, caller's accesses to compressed_size
> (e.g., ntfs_read_locked_inode() or ntfs_attr_update_mapping_pairs()) can
> extend past the attribute declared boundary.
> This can cause OOB reads or OOB writes past the MFT record buffer if the
> attribute is positioned near the end of the MFT record.
>
> The compressed_size field is accessed from:
> - ntfs_read_locked_inode()
> - ntfs_read_locked_attr_inode()
> - ntfs_attr_open()
> - ntfs_attr_update_mapping_pairs()
>
> ntfs_attr_make_non_resident() seems to be safe.
>
> Fixing this by raising min_len for sparse/compressed attributes in the
> validator.
>
> The OOB reads and the OOB writes require a crafted filesystem image, which
> is not in the kernel threat model, anyway, fixing memory errors would be
> nice to keep things secure.
>
> Signed-off-by: Alexandro Calo <alexandro.calo@xxxxxxxxxxxxxxxxxx>
Applied it to #ntfs-next.
Thanks!