Re: [PATCH] fs/ntfs3: fix out-of-bounds write in ni_create_attr_list()

Re: [PATCH] fs/ntfs3: fix out-of-bounds write in ni_create_attr_list()

[hewei-gikaku]

Hi Weiming, Xiang,

I posted a fix for this exact ni_create_attr_list() out-of-bounds write
two weeks before this patch, to the same list and CC'ing the same
maintainer:

  v1 (2026-06-10): https://lore.kernel.org/all/20260610002929.51765-1-skyexpoc@gmail.com/
  v2 (2026-06-25): https://lore.kernel.org/all/20260625031932.9412-1-skyexpoc@gmail.com/

Same root cause, same Fixes: tag.  The two patches differ in how they fix
it, and the difference matters:

  - This patch keeps the fixed al_aligned(record_size) buffer and returns
    -EINVAL as soon as an entry would cross the buffer end.  Because each
    ATTR_LIST_ENTRY (le_size(0) = 0x20) is larger than the minimum resident
    attribute it represents (SIZEOF_RESIDENT = 0x18), the list can grow past
    a single record_size for a sufficiently full base record, so this can
    fail a normal setxattr/file operation with -EINVAL instead of handling
    it.

  - My v2 computes the exact list size from the attributes first and
    allocates accordingly, closing the overflow without introducing that
    regression.

Given the earlier posting and that v2 fixes the bug without rejecting
otherwise-valid records, I'd suggest taking v2.  I'm happy to rebase it or
adjust to whatever Konstantin prefers.

Thanks,
HE WEI

Re: [PATCH] fs/ntfs3: fix out-of-bounds write in ni_create_attr_list()

[Konstantin Komarov]

On 6/26/26 15:11, hewei-gikaku wrote:

> Hi Weiming, Xiang,
>
> I posted a fix for this exact ni_create_attr_list() out-of-bounds write
> two weeks before this patch, to the same list and CC'ing the same
> maintainer:
>
>    v1 (2026-06-10): https://lore.kernel.org/all/20260610002929.51765-1-skyexpoc@gmail.com/
>    v2 (2026-06-25): https://lore.kernel.org/all/20260625031932.9412-1-skyexpoc@gmail.com/
>
> Same root cause, same Fixes: tag.  The two patches differ in how they fix
> it, and the difference matters:
>
>    - This patch keeps the fixed al_aligned(record_size) buffer and returns
>      -EINVAL as soon as an entry would cross the buffer end.  Because each
>      ATTR_LIST_ENTRY (le_size(0) = 0x20) is larger than the minimum resident
>      attribute it represents (SIZEOF_RESIDENT = 0x18), the list can grow past
>      a single record_size for a sufficiently full base record, so this can
>      fail a normal setxattr/file operation with -EINVAL instead of handling
>      it.
>
>    - My v2 computes the exact list size from the attributes first and
>      allocates accordingly, closing the overflow without introducing that
>      regression.
>
> Given the earlier posting and that v2 fixes the bug without rejecting
> otherwise-valid records, I'd suggest taking v2.  I'm happy to rebase it or
> adjust to whatever Konstantin prefers.
>
> Thanks,
> HE WEI

Hello,

Sorry for the delay.
I'll stick to the He Wei patch for this fix.

Regards,
Konstantin