The mapping pairs decoder validates that the starting LCN is within the
volume but does not check if the run extends beyond the volume boundary.

A malformed NTFS image with a crafted mapping pairs array could cause
the kernel to access memory beyond the volume boundary, potentially leading
to memory corruption and privilege escalation.

Add validation to ensure lcn + length stays within nr_clusters.

Cc: stable@vger.kernel.org
Fixes: b4be3a47f8ba4 ("ntfs: bound the free-cluster bitmap scan to the volume")
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
 fs/ntfs/runlist.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/fs/ntfs/runlist.c b/fs/ntfs/runlist.c
index 17eb275a21ff..9eaadbc0ef47 100644
--- a/fs/ntfs/runlist.c
+++ b/fs/ntfs/runlist.c
@@ -897,6 +897,28 @@ struct runlist_element *ntfs_mapping_pairs_decompress(const struct ntfs_volume *
 				goto err_out;
 			}
 
+			if (lcn >= 0) {
+				s64 run_end;
+
+				/*
+				 * Ensure that the run stays within the volume.
+				 * A valid starting LCN is not sufficient because
+				 * the run length comes from disk.
+				 */
+				if (unlikely(check_add_overflow(lcn,
+						rl[rlpos].length,
+						&run_end))) {
+					ntfs_error(vol->sb,
+							"Run length overflow in mapping pairs array.");
+					goto err_out;
+				}
+				if (unlikely(run_end > (s64)vol->nr_clusters)) {
+					ntfs_error(vol->sb,
+							"Run extends beyond volume boundary.");
+					goto err_out;
+				}
+			}
+
 			/* chkdsk accepts zero-sized runs only for holes */
 			if ((lcn != -1) && !rl[rlpos].length) {
 				ntfs_error(vol->sb,
-- 
2.25.1

On Tue, Aug 11, 2026 at 11:15 AM Hongling Zeng <zenghongling@kylinos.cn> wrote:
>
> The mapping pairs decoder validates that the starting LCN is within the
> volume but does not check if the run extends beyond the volume boundary.
>
> A malformed NTFS image with a crafted mapping pairs array could cause
> the kernel to access memory beyond the volume boundary, potentially leading
> to memory corruption and privilege escalation.
>
> Add validation to ensure lcn + length stays within nr_clusters.
>
> Cc: stable@vger.kernel.org
> Fixes: b4be3a47f8ba4 ("ntfs: bound the free-cluster bitmap scan to the volume")
> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Applied it to #ntfs-next.
Thanks!