From: rtm@csail.mit.edu
To: Namjae Jeon <linkinjeon@kernel.org>, Hyunchul Lee <hyc.lee@gmail.com>
Cc: linux-fsdevel@vger.kernel.org
Subject: a negative ntfs superblock mft_lcn can cause a wild memory reference
Date: Mon, 17 Aug 2026 17:03:22 -0400 [thread overview]
Message-ID: <57514.1787000602@localhost> (raw)
If the ntfs superblock's mft_lcn is negative, that will pass tests
such as
ll = le64_to_cpu(b->mft_lcn);
if (ll >= vol->nr_clusters) {
and
vol->mft_zone_end = vol->mft_lcn + mft_zone_size;
while (vol->mft_zone_end >= vol->nr_clusters) {
because the variables are signed.
The attached corrupt NTFS image exploits this to cause index to be
out of bounds in ntfs_cluster_alloc(), e.g. for
if (vol->lcn_empty_bits_per_page[index] == 0)
goto next_bmp_pos;
index is derived from mft_lcn via mft_zone_end, data1_zone_pos,
zone_start, and bmp_pos.
# wget http://www.rtmrtm.org/rtm/ntfs8b.img.gz
# gunzip ntfs8b.img.gz
# cp ntfs8b.img junk
# mount -t ntfs -o loop junk /mnt
# echo x > /mnt/x
ntfs: (device loop0): check_mft_mirror(): $MFT and $MFTMirr record 0 do not match. Run chkdsk.
BUG: unable to handle page fault for address: ffff80010e38ef58
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
CPU: 10 UID: 0 PID: 1264 Comm: tcsh Not tainted 7.2.0-rc7-00016-g3d6d817622b0 #40 PREEMPT(full)
Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021
RIP: 0010:ntfs_cluster_alloc+0x376/0x12a0
Call Trace:
<TASK>
? inode_io_list_move_locked+0xa1/0xe0
? folio_mark_dirty+0x33/0x60
ntfs_mft_data_extend_allocation_nolock+0x15b/0xa30
ntfs_mft_record_alloc+0x921/0x1790
__ntfs_create+0x1c4/0xd40
? ntfs_attr_put_search_ctx+0x3b/0x50
? kmem_cache_free+0x207/0x2f0
? __mark_inode_dirty+0x16a/0x3b0
ntfs_create+0xc1/0x170
path_openat+0xfe0/0x12f0
? do_syscall_64+0xf9/0x540
? do_getname+0x2e/0x180
do_file_open+0xdf/0x1a0
do_sys_openat2+0x79/0xe0
__x64_sys_creat+0x49/0x70
x64_sys_call+0x1bfa/0x2130
do_syscall_64+0xf9/0x540
? exc_page_fault+0x76/0x130
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Robert Morris
rtm@mit.edu
reply other threads:[~2026-08-17 21:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=57514.1787000602@localhost \
--to=rtm@csail.mit.edu \
--cc=hyc.lee@gmail.com \
--cc=linkinjeon@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox