Re: [BUG/RFC] ntfs: crafted image triggers WARN_ON in ntfs_map_runlist_nolock()

[Namjae Jeon]

On Thu, Jul 2, 2026 at 7:12 AM 이상호 <kudo3228@xxxxxxxxx> wrote:
>
> Hi,
Hi Sangho,
>
> I found a crafted NTFS image that triggers the following warning during
> mount-time NTFS logfile handling:
>
>   WARNING: fs/ntfs/attrib.c:177 at ntfs_map_runlist_nolock+0x1275/0x17b0
>
> The observed stack is:
>
>   ntfs_map_runlist_nolock
>   ntfs_empty_logfile
>   load_system_files
>   ntfs_fill_super
>   get_tree_bdev_flags
>   vfs_get_tree
>   do_new_mount
>   __se_sys_mount
>
> The warning site is:
>
>   fs/ntfs/attrib.c:177
>   WARN_ON(!ctx->attr->non_resident);
>
> The caller path reaches this through:
>
>   fs/ntfs/logfile.c:677
>   err = ntfs_map_runlist_nolock(log_ni, vcn, NULL);
>
> The current hypothesis is that a malformed image reaches the $LogFile cleanup
> path and causes ntfs_map_runlist_nolock() to find a resident attribute where it
> expects a non-resident one. Since the input is a crafted filesystem image, this
> looks like it should be rejected through an ordinary mount error path rather
> than tripping a kernel WARN_ON().
>
> The crash was found with syzkaller/SyzDirect on a recent local mainline build.
> syz-repro reproduced the warning during minimization and reduced the syscall
> sequence to syz_mount_image$ntfs. I also extracted the crashing program from
> the syzkaller log and generated a standalone C reproducer from it. The generated
> C reproducer compiles locally.
>
> I have not yet confirmed whether this has impact beyond a mount-time warning
> from a crafted NTFS image. I can provide the full syzkaller/C reproducer and
> kernel config if useful.
I will check it and share the patch with you to get your confirmation.
Thanks.