red zone violation in ntfs_runlists_merge()

red zone violation in ntfs_runlists_merge()

[rtm]

The following mounts a corrupt NTFS image that produces a red zone
violation:

# uname -a
Linux xxx 7.2.0-rc7-00016-g3d6d817622b0 #40 SMP PREEMPT_DYNAMIC Wed Aug 12 13:01:40 EDT 2026 x86_64 x86_64 x86_64 GNU/Linux
# wget http://www.rtmrtm.org/rtm/ntfs2b.img.gz
# gunzip ntfs2b.img.gz
mount -t ntfs -o loop ntfs2b.img /mnt
[Right Redzone overwritten] 0xffff888100321300-0xffff888100321307 @offset=4864. 
...

The overrun occurs in the last three lines of this code in
ntfs_runlists_merge():

                        drl[ds].length = marker_vcn - drl[ds].vcn;
                        /* Finally add the ENOENT terminator. */
                        ds++;
                        if (!slots) {
                                drl = ntfs_rl_realloc_nofail(drl, ds, ds + 1);
                                rtm_check(drl);
                                *new_rl_count += 1;
                        }
                        drl[ds].vcn = marker_vcn;
                        drl[ds].lcn = LCN_ENOENT;
                        drl[ds].length = (s64)0;

After the ds++, ds is too large, but slots == 1.

Robert Morris
rtm@mit.edu

Re: red zone violation in ntfs_runlists_merge()

[Hyunchul Lee]

Hi Robert,

I have submitted a patch for this issue:

https://lore.kernel.org/all/20260819-fix-empty-mp-v1-1-fb60b2eeca51@gmail.com/

2026년 8월 17일 (월) 오전 4:06, <rtm@csail.mit.edu>님이 작성:
>
> The following mounts a corrupt NTFS image that produces a red zone
> violation:
>
> # uname -a
> Linux xxx 7.2.0-rc7-00016-g3d6d817622b0 #40 SMP PREEMPT_DYNAMIC Wed Aug 12 13:01:40 EDT 2026 x86_64 x86_64 x86_64 GNU/Linux
> # wget http://www.rtmrtm.org/rtm/ntfs2b.img.gz
> # gunzip ntfs2b.img.gz
> mount -t ntfs -o loop ntfs2b.img /mnt
> [Right Redzone overwritten] 0xffff888100321300-0xffff888100321307 @offset=4864.
> ...
>
> The overrun occurs in the last three lines of this code in
> ntfs_runlists_merge():
>
>                         drl[ds].length = marker_vcn - drl[ds].vcn;
>                         /* Finally add the ENOENT terminator. */
>                         ds++;
>                         if (!slots) {
>                                 drl = ntfs_rl_realloc_nofail(drl, ds, ds + 1);
>                                 rtm_check(drl);
>                                 *new_rl_count += 1;
>                         }
>                         drl[ds].vcn = marker_vcn;
>                         drl[ds].lcn = LCN_ENOENT;
>                         drl[ds].length = (s64)0;
>
> After the ds++, ds is too large, but slots == 1.
>
> Robert Morris
> rtm@mit.edu
>


-- 
Thanks,
Hyunchul