[PATCH] ntfs3: reject on-disk c_unit values that cause shift overflow

[Joas Antonio dos Santos via B4 Relay <devnull+joasantonio108.gmail.com@kernel.org>]

From: Joas Antonio dos Santos <joasantonio108@gmail.com>

The c_unit field of non-resident NTFS attributes controls frame size
via shift expressions like 1u << c_unit throughout attrib.c. This
field is read directly from the on-disk MFT record without bounds
validation for extended (compressed/sparse) attributes.

When c_unit >= 32, the expression 1u << c_unit is undefined behavior
for 32-bit integers. On x86, the shift count is masked to 5 bits,
producing wrong frame alignment (e.g., c_unit=32 yields 1u << 0 = 1
instead of 2^32). On strict-alignment architectures this may trap.

The affected expressions in attrib.c include:
  - 1u << attr_b->nres.c_unit (lines 1168, 1732)
  - align <<= attr_b->nres.c_unit (line 501)
  - sbi->cluster_size << attr_b->nres.c_unit (lines 2089, 2401, 2617)

Add a bounds check in mi_enum_attr() to reject attributes with
c_unit > 31, which covers all downstream users. The existing
validation in frecord.c (checking c_unit == NTFS_LZNT_CUNIT) only
covers explicit compression read/write paths, not the attrib.c
block mapping, truncate, fallocate, and punch_hole paths.

A crafted NTFS image with c_unit=32 triggers the UB on mount when
any compressed file is accessed.

Found by LLM-assisted manual code review.

Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations")
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
 fs/ntfs3/record.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index d7785f9e8..5344958ef 100644
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -366,6 +366,9 @@ struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi,
 
 		if (tot_size > alloc_size)
 			goto out;
+
+		if (attr->nres.c_unit > 31)
+			goto out;
 	} else {
 		if (attr->nres.c_unit)
 			goto out;

---
base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
change-id: 20261108-ntfs3-cunit-fix-f1c127013b75

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@gmail.com>