From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B5BE3A6411 for ; Wed, 1 Jul 2026 22:12:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782943966; cv=none; b=PaKCSh0XMy/FVBm8YVvDtL/kLhLeCKOEXwZbIlOuS4eQPhcMHNx4qMTMIJAQYUfCudBN5us5/UY5bZB1sdtb5A4rvAdiuFZJe/dxRkV/i8LDyXgEVtodTMviEoEzaFPdr1EHK0m7579CQSnm4AS7rzn8SH6xls1uGakkVgG/SvM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782943966; c=relaxed/simple; bh=ka8gPEmyfqzBFsUMgLAkSisRH1vQW2tER46iuHNVhL0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=b+mty248P04MgqRZ/XOoo1NeJydSMVxRPkxUz+1/w53/PE+31KTJcq/XXRxugAcRJYDayi0s9+vtZUjeSZLwvmf6LUWC6oJdRaD9wyBH6LxdXq/yxHrgHBEWUGnsV2/HSWJJfP4t2i4zW7PcqhuOa8FjNkhGZ1iq7P92FqRYhic= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HBx42Suf; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HBx42Suf" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2c9ed0c7fc7so11820475ad.1 for ; Wed, 01 Jul 2026 15:12:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782943964; x=1783548764; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Uy9dIN6TDlPqLoiaW8jsGbOVS1uf9xXByuLYxsJLLP4=; b=HBx42Suf3xgTQqGkgMcM1WTZ/RKyDlXQfLWmmmat6qwmSqLZiTrxZCiFZHgpaPix72 AjUziRtkutYMm9ZHRbyk62L1n3rQYBv/iCIvPACZtZzXryRSdUPRS8jmExyxYBfEboNj 7YeQnRaOfdjKIo2I7wd20mXV/Fm4SA8jdurN/gOMoRkkrGkWg1TbkKR0uNdIlM9/vJCs 7kJw4UbYGwbOhx83Y9yWqw50CNXDxYiNui4uszmMxW+a9Ljc0buixQ6D3MM2SSASBetd Iau4TCaMiMT+sgR4k/4sOgmbE9cSE6yoVKj/zdxU3btVybonbe+CwdtnB5HQjFWXaZol sDXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782943964; x=1783548764; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Uy9dIN6TDlPqLoiaW8jsGbOVS1uf9xXByuLYxsJLLP4=; b=flTyYbQOEERREYu+5MyEeZyp6rSuYosHD6X9J236UVEq+pqe1QkxLwBcMd3ju0UPIe wEUx/KQ6HT4ho6SNLU1s0iKTXOvoUIczlCXtCVcYbsDSxgNDTDOzYskhnRmJW5sdj9zB wGpoei+W0jVYSqhu/9mUJxSZ99c/HRhgGd8Yd60iSC57UG3lsk5etTBzoUiUaUVgJr2Z ubAEUU5GAAW0cX/thvTthCq/SKVBtMFoH6m8PCSnnU4dZlKSTXa9Huhh46DdlVb/zWeY GfKkimBPMqHeZPP6y780nzLE/pyhC1POIRdHh+nqJ/QYTTjuyvmdWJ25mpqajVvO21FU fY8A== X-Forwarded-Encrypted: i=1; AHgh+RoZ2AsWKyy6VNu1xt1yLOOYN/rim/69ywtokgM7TymfSvqLxjuqYDjh8sROfl3hLUs9zhapMK86wTouPgo=@vger.kernel.org X-Gm-Message-State: AOJu0Yw3Nb9KY5EKaomQldVqVqAGnw78u2anRdSGGA/H7PRFhn0PkFNb Dk9ImB/zkrNSrY15ufntVNVR9SI2LqHX75FuHtHNXvqBB3hXA5+HXEuD X-Gm-Gg: AfdE7cnbGJqcrtf40NIZwHnZT8w55tvNxSBk/jbOnLXZ9u0vw2NQTiDi17n2h1qlfHm hrTqtX8AYpxRRv9swiIVlQqoxU7aA5t6uNR/yG08pcwgzDnUEZuaS9JxUEoNYyfbm2IbisijOTV fa2QDt4sXF60jcjdqyy9PHPRWDWwyGasxgFScrC/W4iCxClKQSni+s832R4NA8mT5HlhOQrJjlN 2Rv0E3dt+Arfyq7c8SGN4uflWBpO2CSV9YYeUaEBSAVf7FE7fv0DuBAuibWPOipvehpZBR4Vbwy m1CtsiuSRjoY+JZs3WPJ57egKTwJ6H/tcuDTPtAu9bSbaOlvMLH/gem8KvaKfGa3gOxOXJDIZSl Hrb4rcsz2oFcbQJmnF6b7LcmQguTq3VgsvvckS0ovp5FGzfoFkFiSXUTrxeieYgS+cS3cWOjy6X 4BanLXNPgJRUVrRk3Gz1K0G91zZPeS4h4gpWuqQ9O6rCoFWUlp+7Z3OYAWY/duY6Y= X-Received: by 2002:a17:902:d549:b0:2c9:c991:3bf0 with SMTP id d9443c01a7336-2ca7e682ad6mr38439375ad.8.1782943964222; Wed, 01 Jul 2026 15:12:44 -0700 (PDT) Received: from DESKTOP-L3Q0GIV.localdomain ([203.230.195.19]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ca9a8dade5sm4384595ad.13.2026.07.01.15.12.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Jul 2026 15:12:40 -0700 (PDT) From: =?UTF-8?q?=EC=9D=B4=EC=83=81=ED=98=B8?= To: Namjae Jeon , Hyunchul Lee Cc: =?UTF-8?q?=EC=9D=B4=EC=83=81=ED=98=B8?= , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [BUG/RFC] ntfs: crafted image triggers WARN_ON in ntfs_map_runlist_nolock() Date: Thu, 2 Jul 2026 07:12:37 +0900 Message-ID: <20260701221237.822167-1-kudo3228@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hi, I found a crafted NTFS image that triggers the following warning during mount-time NTFS logfile handling: WARNING: fs/ntfs/attrib.c:177 at ntfs_map_runlist_nolock+0x1275/0x17b0 The observed stack is: ntfs_map_runlist_nolock ntfs_empty_logfile load_system_files ntfs_fill_super get_tree_bdev_flags vfs_get_tree do_new_mount __se_sys_mount The warning site is: fs/ntfs/attrib.c:177 WARN_ON(!ctx->attr->non_resident); The caller path reaches this through: fs/ntfs/logfile.c:677 err = ntfs_map_runlist_nolock(log_ni, vcn, NULL); The current hypothesis is that a malformed image reaches the $LogFile cleanup path and causes ntfs_map_runlist_nolock() to find a resident attribute where it expects a non-resident one. Since the input is a crafted filesystem image, this looks like it should be rejected through an ordinary mount error path rather than tripping a kernel WARN_ON(). The crash was found with syzkaller/SyzDirect on a recent local mainline build. syz-repro reproduced the warning during minimization and reduced the syscall sequence to syz_mount_image$ntfs. I also extracted the crashing program from the syzkaller log and generated a standalone C reproducer from it. The generated C reproducer compiles locally. I have not yet confirmed whether this has impact beyond a mount-time warning from a crafted NTFS image. I can provide the full syzkaller/C reproducer and kernel config if useful. Thanks, 이상호