From: rtm@csail.mit.edu
To: Namjae Jeon <linkinjeon@kernel.org>, Hyunchul Lee <hyc.lee@gmail.com>
Cc: linux-fsdevel@vger.kernel.org
Subject: ntfs_inode_attr_pread(pos<0) can dereference bad pointer
Date: Sun, 16 Aug 2026 16:24:15 -0400 [thread overview]
Message-ID: <16859.1786911855@localhost> (raw)
ntfs_inode_attr_pread()'s check on its pos argument is
if (pos > isize) {
mutex_unlock(&ni->mrec_lock);
return -EINVAL;
}
which allows pos to be negative, allowing this to potentially read from
a wild pointer:
memcpy(buf, (u8 *)attr + pos, count);
A demo using a corrupt NTFS image:
# uname -a
Linux xxx 7.2.0-rc7-00016-g3d6d817622b0 #40 SMP PREEMPT_DYNAMIC Wed Aug 12 13:01:40 EDT 2026 x86_64 x86_64 x86_64 GNU/Linux
# wget http://www.rtmrtm.org/rtm/ntfs23d.img.gz
# gunzip ntfs23d.img.gz
# mount -t ntfs -o loop,rw junk /mnt
# ls /mnt
ntfs: (device loop0): ntfs_lookup_inode_by_name(): Corrupt directory. Aborting lookup.
Oops: general protection fault, probably for non-canonical address 0x7fff88c0c159a850: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
CPU: 3 UID: 0 PID: 1273 Comm: ls Not tainted 7.2.0-rc7-00016-g3d6d817622b0 #40 PREEMPT(full)
Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021
Call Trace:
<TASK>
? ntfs_inode_attr_pread+0x26d/0x2f0
? __kvmalloc_node_noprof+0x1f0/0x5b0
ntfs_ib_read+0x3d/0xd0
ntfs_index_walk_down+0x76/0x120
ntfs_readdir+0x7e5/0xa60
? selinux_file_permission+0x127/0x190
iterate_dir+0x91/0x150
__x64_sys_getdents64+0x77/0x110
? __pfx_filldir64+0x10/0x10
x64_sys_call+0xfd0/0x2130
Robert Morris
rtm@mit.edu
reply other threads:[~2026-08-16 20:24 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=16859.1786911855@localhost \
--to=rtm@csail.mit.edu \
--cc=hyc.lee@gmail.com \
--cc=linkinjeon@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.