github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 22:14:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

Browse Source 
In mi_enum_attr(), the start/end VCN validation for non-resident
attributes is:

	if (svcn > evcn + 1) goto out;

When evcn is U64_MAX the "evcn + 1" expression wraps to 0 and any svcn
passes the check. For evcn values close to U64_MAX (but not equal to it)
the right-hand side is still a meaningless near-wrap upper bound, so a
malformed on-disk attribute with svcn == 0 and evcn near U64_MAX can pass
mi_enum_attr() unrejected.

VCN (virtual cluster number) is a cluster index, so any valid evcn is
bounded by the volume's total cluster count, which ntfs3 holds in
sbi->used.bitmap.nbits (set up in ntfs_init_from_boot() before any caller
of mi_enum_attr() runs). Reject evcn values that fall outside this range.

However, an empty non-resident attribute (no allocated clusters) is
legitimately encoded with svcn == 0 and evcn == -1 (U64_MAX), e.g. via
attr->nres.evcn = cpu_to_le64((u64)vcn - 1) with vcn == 0. That sentinel
must keep passing, so exclude evcn == U64_MAX from the range check. The
existing "svcn > evcn + 1" test still tolerates the sentinel ("0 > 0" is
false) and continues to require svcn == 0 for it, while the range check
rejects every other out-of-range evcn and thereby also defuses the
"evcn + 1" wraparound.

svcn does not need its own bound: once evcn < nbits, "svcn > evcn + 1"
implies svcn <= nbits.

Fixes: 013ff63b64 ("fs/ntfs3: Add more attributes checks in mi_enum_attr()")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
[almaz.alexandrovich@paragon-software.com: fixed evcn check]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
This commit is contained in:
Zhan Xusheng 2026-06-24 11:44:30 +08:00 committed by Konstantin Komarov
parent c510c63873
commit 20fd9f64c0
No known key found for this signature in database
GPG Key ID: A9B0331F832407B6
1 changed files with 31 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
fs/ntfs3/record.c
View File

@ -202,7 +202,7 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
u32 used = le32_to_cpu(rec->used);
u32 t32, off, asize, prev_type;
u16 t16;
u64 data_size, alloc_size, tot_size;
u64 svcn, evcn, data_size, alloc_size, tot_size;
if (!attr) {
u32 total = le32_to_cpu(rec->total);
@ -310,10 +310,38 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
if (t32 && le16_to_cpu(attr->name_off) + t32 > t16)
goto out;
/* Check start/end vcn. */
if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)
/*
* Check start/end vcn. svcn == 0 with evcn == -1 (U64_MAX) is the
* sentinel for an empty non-resident attribute (no allocated
* clusters) and must be accepted: "svcn > evcn + 1" tolerates it,
* since "(u64)-1 + 1" is 0 and "0 > 0" is false.
*
* For a non-empty attribute evcn is a cluster index and must lie
* within the volume (sbi->used.bitmap.nbits, set up in
* ntfs_init_from_boot() before any caller of mi_enum_attr() runs).
* Bounding evcn also prevents a malformed value close to U64_MAX
* from slipping through the near-wrap "evcn + 1" upper bound.
*/
svcn = le64_to_cpu(attr->nres.svcn);
evcn = le64_to_cpu(attr->nres.evcn);
if (svcn > evcn + 1)
goto out;
if (is_attr_ext(attr)) {
/* sparsed/compressed attribute. */
#ifdef CONFIG_NTFS3_64BIT_CLUSTER
/* No limits. */
#else
/* Check evcn fits into 32 bits. */
if (evcn != U64_MAX && evcn >= (1ull << 32))
goto out;
#endif
} else {
/* Check out of volume for normal attribute. */
if (evcn != U64_MAX && evcn >= mi->sbi->used.bitmap.nbits)
goto out;
}
data_size = le64_to_cpu(attr->nres.data_size);
if (le64_to_cpu(attr->nres.valid_size) > data_size)
goto out;