Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size. Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator") Reported-by: Robert Morris Closes: https://lore.kernel.org/all/9519.1786907182@localhost/ Cc: stable@vger.kernel.org Signed-off-by: Hyunchul Lee --- Changes in v2: * Restore reloading highest_vcn after mapping-pairs decoding. * Add the validation of empty mapping-pairs to accept only lowest_vcn == 0 and highest_vcn == -1. fs/ntfs/runlist.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/fs/ntfs/runlist.c b/fs/ntfs/runlist.c index 9eaadbc0ef47..00373e450ea7 100644 --- a/fs/ntfs/runlist.c +++ b/fs/ntfs/runlist.c @@ -772,6 +772,25 @@ struct runlist_element *ntfs_mapping_pairs_decompress(const struct ntfs_volume * return ERR_PTR(-EIO); } + /* + * An empty mapping-pairs array is valid only for a zero-length + * attribute. + */ + if (!*buf && + (vcn || + le64_to_cpu(attr->data.non_resident.highest_vcn) != + (u64)(vcn - 1) || + le64_to_cpu(attr->data.non_resident.allocated_size) || + le64_to_cpu(attr->data.non_resident.data_size) || + le64_to_cpu(attr->data.non_resident.initialized_size))) { + ntfs_error(vol->sb, "Invalid empty mapping pairs array."); + return ERR_PTR(-EIO); + } + if (!vcn && !*buf && old_runlist && old_runlist->rl) { + *new_rl_count = old_runlist->count; + return old_runlist->rl; + } + /* Current position in runlist array. */ rlpos = 0; /* Allocate first page and set current runlist size to one page. */ --- base-commit: df7dce2090342170b7643d36f694204cae7792a9 change-id: 20260819-fix-empty-mp-3f32eb769112 Best regards, -- Thanks, Hyunchul