[PATCH] ntfs: prevent out-of-bounds write from a corrupt runlist

[Dennis Tighe]

For the cluster bitmap ($Bitmap), __ntfs_bitmap_set_bits_in_run() uses a
cluster number as an index into vol->lcn_empty_bits_per_page[] via
ntfs_set_lcn_empty_bits(), with no upper bound on the index.  On the
deallocation path that cluster number is read from an on-disk runlist, so a
corrupted runlist naming a cluster beyond the end of the volume writes past
the end of the array into adjacent memory when a file is freed.

Reject cluster ranges outside the volume before updating the array,
mirroring the nr_clusters check already used in ntfs_trim_fs().

Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dennis Tighe <dennis.tighe@xxxxxxxxx>
---
 fs/ntfs/bitmap.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/fs/ntfs/bitmap.c b/fs/ntfs/bitmap.c
index b1436b3..fb65bce 100644
--- a/fs/ntfs/bitmap.c
+++ b/fs/ntfs/bitmap.c
@@ -138,6 +138,21 @@ int __ntfs_bitmap_set_bits_in_run(struct inode *vi, 
const s64 start_bit,
     if (start_bit < 0 || cnt < 0 || value > 1)
         return -EINVAL;

+    /*
+     * For $Bitmap, @start_bit is a cluster number that comes from an
+     * on-disk runlist on the free path.  A corrupt runlist can name a
+     * cluster past the end of the volume and index
+     * vol->lcn_empty_bits_per_page[] out of bounds below, so reject it.
+     */
+    if (ni->mft_no == FILE_Bitmap &&
+        (start_bit >= vol->nr_clusters || cnt > vol->nr_clusters - 
start_bit)) {
+        ntfs_error(vi->i_sb,
+               "Cluster range (0x%llx+0x%llx) outside volume 0x%llx; 
corrupt runlist.",
+               (unsigned long long)start_bit, (unsigned long long)cnt,
+               (unsigned long long)vol->nr_clusters);
+        return -EIO;
+    }
+
     /*
      * Calculate the indices for the pages containing the first and last
      * bits, i.e. @start_bit and @start_bit + @cnt - 1, respectively.
--
2.47.3