Unverified Commit 06909b25 authored Dec 02, 2025 by Jaehun Gou Committed by Konstantin Komarov Dec 19, 2025

fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST



We found an infinite loop bug in the ntfs3 file system that can lead to a
Denial-of-Service (DoS) condition.

A malformed NTFS image can cause an infinite loop when an ATTR_LIST attribute
indicates a zero data size while the driver allocates memory for it.

When ntfs_load_attr_list() processes a resident ATTR_LIST with data_size set
to zero, it still allocates memory because of al_aligned(0). This creates an
inconsistent state where ni->attr_list.size is zero, but ni->attr_list.le is
non-null. This causes ni_enum_attr_ex to incorrectly assume that no attribute
list exists and enumerates only the primary MFT record. When it finds
ATTR_LIST, the code reloads it and restarts the enumeration, repeating
indefinitely. The mount operation never completes, hanging the kernel thread.

This patch adds validation to ensure that data_size is non-zero before memory
allocation. When a zero-sized ATTR_LIST is detected, the function returns
-EINVAL, preventing a DoS vulnerability.

Co-developed-by: Seunghun Han <kkamagui@gmail.com>
Signed-off-by: Seunghun Han <kkamagui@gmail.com>
Co-developed-by: Jihoon Kwon <kjh010315@gmail.com>
Signed-off-by: Jihoon Kwon <kjh010315@gmail.com>
Signed-off-by: Jaehun Gou <p22gone@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

parent 4b90f16e

fs/ntfs3/attrlist.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -52,6 +52,11 @@ int ntfs_load_attr_list(struct ntfs_inode ni, struct ATTRIB attr)

		if (!attr->non_res) {
		lsize = le32_to_cpu(attr->res.data_size);
		if (!lsize) {
		err = -EINVAL;
		goto out;
		}

		/* attr is resident: lsize < record_size (1K or 4K) */
		le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
		if (!le) {
		@@ -66,6 +71,10 @@ int ntfs_load_attr_list(struct ntfs_inode ni, struct ATTRIB attr)
		u16 run_off = le16_to_cpu(attr->nres.run_off);

		lsize = le64_to_cpu(attr->nres.data_size);
		if (!lsize) {
		err = -EINVAL;
		goto out;
		}

		run_init(&ni->attr_list.run);