Re: [PATCH] ntfs: prevent out-of-bounds write from a corrupt runlist

[Hyunchul Lee]

Hi Dennis,

2026년 8월 15일 (토) 오후 3:41, Dennis Tighe <dennis.tighe@xxxxxxxxx>님이 작성:
>
> For the cluster bitmap ($Bitmap), __ntfs_bitmap_set_bits_in_run() uses a
> cluster number as an index into vol->lcn_empty_bits_per_page[] via
> ntfs_set_lcn_empty_bits(), with no upper bound on the index.  On the
> deallocation path that cluster number is read from an on-disk runlist, so a
> corrupted runlist naming a cluster beyond the end of the volume writes past
> the end of the array into adjacent memory when a file is freed.
>
> Reject cluster ranges outside the volume before updating the array,
> mirroring the nr_clusters check already used in ntfs_trim_fs().
>
> Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dennis Tighe <dennis.tighe@xxxxxxxxx>
> ---
>   fs/ntfs/bitmap.c | 15 +++++++++++++++
>   1 file changed, 15 insertions(+)
>
> diff --git a/fs/ntfs/bitmap.c b/fs/ntfs/bitmap.c
> index b1436b3..fb65bce 100644
> --- a/fs/ntfs/bitmap.c
> +++ b/fs/ntfs/bitmap.c
> @@ -138,6 +138,21 @@ int __ntfs_bitmap_set_bits_in_run(struct inode *vi,
> const s64 start_bit,
>       if (start_bit < 0 || cnt < 0 || value > 1)
>           return -EINVAL;
>
> +    /*
> +     * For $Bitmap, @start_bit is a cluster number that comes from an
> +     * on-disk runlist on the free path.  A corrupt runlist can name a
> +     * cluster past the end of the volume and index
> +     * vol->lcn_empty_bits_per_page[] out of bounds below, so reject it.
> +     */

The runlist corruption is already rejected by
the preceding commit.

https://lore.kernel.org/all/20260811021548.15328-1-zenghongling@xxxxxxxxxx/

> +    if (ni->mft_no == FILE_Bitmap &&
> +        (start_bit >= vol->nr_clusters || cnt > vol->nr_clusters -
> start_bit)) {
> +        ntfs_error(vi->i_sb,
> +               "Cluster range (0x%llx+0x%llx) outside volume 0x%llx;
> corrupt runlist.",
> +               (unsigned long long)start_bit, (unsigned long long)cnt,
> +               (unsigned long long)vol->nr_clusters);
> +        return -EIO;
> +    }
> +
>       /*
>        * Calculate the indices for the pages containing the first and last
>        * bits, i.e. @start_bit and @start_bit + @cnt - 1, respectively.
> --
> 2.47.3
>


-- 
Thanks,
Hyunchul