[PATCH] ntfs3: fix resident attribute handling in run load paths

[PATCH] ntfs3: fix resident attribute handling in run load paths

[Yi Xie]

Don't dereference nres unless attr->non_res is set.  ni_find_attr() can
succeed with a resident record on a corrupted image, and run_unpack_ex()
would mis-parse it as mapping pairs.

Fix attr_load_runs(), attr_load_runs_vcn() and attr_set_size().

Fixes: 5ec75546dc71 ("ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()")
Signed-off-by: Yi Xie <xieyi@kylinos.cn>
---
 fs/ntfs3/attrib.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
index c621a4c582f9..248a6d68eac3 100644
--- a/fs/ntfs3/attrib.c
+++ b/fs/ntfs3/attrib.c
@@ -61,11 +61,16 @@ static int attr_load_runs(struct ATTRIB *attr, struct ntfs_inode *ni,
 			  struct runs_tree *run, const CLST *vcn)
 {
 	int err;
-	CLST svcn = le64_to_cpu(attr->nres.svcn);
-	CLST evcn = le64_to_cpu(attr->nres.evcn);
+	CLST svcn, evcn;
 	u32 asize;
 	u16 run_off;
 
+	if (!attr->non_res)
+		return -EIO;
+
+	svcn = le64_to_cpu(attr->nres.svcn);
+	evcn = le64_to_cpu(attr->nres.evcn);
+
 	if (svcn >= evcn + 1 || run_is_mapped_full(run, svcn, evcn))
 		return 0;
 
@@ -555,6 +560,10 @@ int attr_set_size_ex(struct ntfs_inode *ni, enum ATTR_TYPE type,
 		}
 
 next_le_1:
+		if (!attr->non_res) {
+			err = -EIO;
+			goto out;
+		}
 		svcn = le64_to_cpu(attr->nres.svcn);
 		evcn = le64_to_cpu(attr->nres.evcn);
 	}
@@ -1444,6 +1453,9 @@ int attr_load_runs_vcn(struct ntfs_inode *ni, enum ATTR_TYPE type,
 		return -ENOENT;
 	}
 
+	if (!attr->non_res)
+		return -EIO;
+
 	svcn = le64_to_cpu(attr->nres.svcn);
 	evcn = le64_to_cpu(attr->nres.evcn);
 
-- 
2.34.1

Re: [PATCH] ntfs3: fix resident attribute handling in run load paths

[Konstantin Komarov]

On 7/7/26 04:14, Yi Xie wrote:

> [You don't often get email from xieyi@kylinos.cn. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> Don't dereference nres unless attr->non_res is set.  ni_find_attr() can
> succeed with a resident record on a corrupted image, and run_unpack_ex()
> would mis-parse it as mapping pairs.
>
> Fix attr_load_runs(), attr_load_runs_vcn() and attr_set_size().
>
> Fixes: 5ec75546dc71 ("ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()")
> Signed-off-by: Yi Xie <xieyi@kylinos.cn>
> ---
>   fs/ntfs3/attrib.c | 18 +++++++++++++++---
>   1 file changed, 15 insertions(+), 3 deletions(-)
>
> diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
> index c621a4c582f9..248a6d68eac3 100644
> --- a/fs/ntfs3/attrib.c
> +++ b/fs/ntfs3/attrib.c
> @@ -61,11 +61,16 @@ static int attr_load_runs(struct ATTRIB *attr, struct ntfs_inode *ni,
>                            struct runs_tree *run, const CLST *vcn)
>   {
>          int err;
> -       CLST svcn = le64_to_cpu(attr->nres.svcn);
> -       CLST evcn = le64_to_cpu(attr->nres.evcn);
> +       CLST svcn, evcn;
>          u32 asize;
>          u16 run_off;
>
> +       if (!attr->non_res)
> +               return -EIO;
> +
> +       svcn = le64_to_cpu(attr->nres.svcn);
> +       evcn = le64_to_cpu(attr->nres.evcn);
> +
>          if (svcn >= evcn + 1 || run_is_mapped_full(run, svcn, evcn))
>                  return 0;
>
> @@ -555,6 +560,10 @@ int attr_set_size_ex(struct ntfs_inode *ni, enum ATTR_TYPE type,
>                  }
>
>   next_le_1:
> +               if (!attr->non_res) {
> +                       err = -EIO;
> +                       goto out;
> +               }
>                  svcn = le64_to_cpu(attr->nres.svcn);
>                  evcn = le64_to_cpu(attr->nres.evcn);
>          }
> @@ -1444,6 +1453,9 @@ int attr_load_runs_vcn(struct ntfs_inode *ni, enum ATTR_TYPE type,
>                  return -ENOENT;
>          }
>
> +       if (!attr->non_res)
> +               return -EIO;
> +
>          svcn = le64_to_cpu(attr->nres.svcn);
>          evcn = le64_to_cpu(attr->nres.evcn);
>
> --
> 2.34.1

Hello,

Sorry for the delay.
Your patch was applied, thanks.

Regards,
Konstantin