From: Zhan Xusheng On a volume made with "mkntfs -c 8192", a user can set FILE_ATTR_COMPRESSED on an empty file through system.ntfs_attrib. Writing to the file and reading it back after dropping the page cache then crashes: BUG: KASAN: slab-out-of-bounds in ntfs_read_compressed_block+0xa2c/0x2040 Read of size 8192 at addr ffff88804355a000 by task dd/106 The read path only handles clusters up to 4K. It copies each cluster out of a single page, and a compression block of 16 8K clusters does not fit in the 64K ntfs_compression_buffer. Loading an inode already rejects compressed data on such volumes. Reject the flag change the same way. Fixes: fc053f05ca28 ("ntfs: add reparse and ea operations") Cc: stable@vger.kernel.org Signed-off-by: Zhan Xusheng --- fs/ntfs/ea.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ntfs/ea.c b/fs/ntfs/ea.c index fa5c5c625751..68397b2a4e43 100644 --- a/fs/ntfs/ea.c +++ b/fs/ntfs/ea.c @@ -721,6 +721,11 @@ static int ntfs_new_attr_flags(struct ntfs_inode *ni, __le32 fattr) goto err_out; } + if ((new_aflags & ATTR_IS_COMPRESSED) && ni->vol->cluster_size > 4096) { + err = -EOPNOTSUPP; + goto err_out; + } + if (!a->non_resident) { if (!(new_aflags & (ATTR_IS_SPARSE | ATTR_IS_COMPRESSED))) { err = 0; -- 2.43.0