From nobody Mon Sep 28 18:34:08 2026 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 238A53D6CD5 for ; Wed, 19 Aug 2026 07:19:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787123998; cv=none; b=gDfJ6imaQf9zu9aGoho5HuHBa0Fs1JZDY81qONjYKFTZ+rocGahBJ00hXCeDHu1NmnX1aKFLTXABmPCrcG4o98Eh3eH/980Z4Hik1O07e6NeGF1lRXwhqYzaeFWS/hH5AXLBHzc42ugKPkx3g7sPxtkBs2LIURrFxMb1EYg0hrc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787123998; c=relaxed/simple; bh=SewbY+Oo/Tw2nPKoLGNKhKQUEz+hTDmNyK4kBYHm99Y=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=feL9gMucVQzk4TwIaE8WTtklnhCaAewjgCSFWeSo7Te4OovGVu3KZhTvd7cQdShsl8eMqoQZD69UYUJ8L5/FxO4n1fAZCGqyVBfO/sn1pEXkaocfa9STHPzbeniHUvEhK/gADz8iganBkRkNZQn/T317UsUniwL+f7sJkwnDvzw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YWssIy0X; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YWssIy0X" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2d0407aedd6so6739575ad.0 for ; Wed, 19 Aug 2026 00:19:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787123996; x=1787728796; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=RLTbrtg2Gwo+sdFIDsdeh+A0HG/11by1TkaHcpf2lKA=; b=YWssIy0XH6mj9HTPovMr4Th3SrcxLt2h/feYsAZDpt27hNbRTznMs3YCIN4Gph9WE+ SRHIGbP2cS98Kz8cbfECPrF6HuTeoVNT8nvzY2Ov7tcJM/xAHLk+NFzmUGtKwyPaSi94 LGbtZTnIX4Sh2SM5HUZm6fcm2efSVIMvuLnTu1yFJwqgNIw4lQBEV8CYksAj++d8KqmK PkeCYk/zIcIOWU0zw3ZWrqdalpaUriKnaLAZDo94ph76j2mTTDLJmp6jqVrHT9pSRqKt Ow1pomfSdlRYgva8dJ2TxG49ue3/9bBflB+aXc65qS91OC4Scp3t+Iax+NNEmNuv8QiJ V87Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787123996; x=1787728796; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=RLTbrtg2Gwo+sdFIDsdeh+A0HG/11by1TkaHcpf2lKA=; b=Jq9mOmUeAyydT5H4wdVDpby/BBQPgyAvLIACYby2ePY8oGEDY7asv7vBPvVRgufNA+ HgASkN9/+l+d3aFgK3vfOlPlLV23B4D+YAaclIQgkbZJDLFl/IroS9uVe9S+32tjVUwq HKf16/Ub5n/OQI63YzQ9mtrHEg4j1Z3CDuBC6AHMr52/nCqI8iVc4VgVt3WeaqZHY2pl ZxmH9DC2tTLXrImFCZ+uycuFZCYs1/CVxJVuMNGyPoSFCLVjlLOjfMgtPV/2p/LSgbWO PQmaJ7uQ3shbjy8IRxubf1/VD5zIu8Y0ljZ17Mn8LnnFE+A73w5Xr+qQuRVQfX14pTw4 7saw== X-Forwarded-Encrypted: i=1; AHgh+RpwTuYjDDKnZB8KdkygaSRBGnL+4odj7BzQv4bPnz7UNnqjfB+8LOYjds74GgKzCKWsGAjiReS3Y7aGBh0=@vger.kernel.org X-Gm-Message-State: AOJu0Yypn3xJPZPE5lob7JSLSNLEfOZjbymYEieo0BSZve2vrM8C8/tW T60G4NajXe5U96yhIrnBhggNSpWYte02nzvSsiMIrt0kIzAkOfvhGy0t X-Gm-Gg: AR+sD12Gm3Yi0muIzRtm9FjQdCsu8ITNLTjP0SegUkLUZi41x2ltNLE7l4n3nr5yTsz aSbsV2gasCcycDoNOPWC/DUFNSwkXSKQyZq/3+D4uuKhJxs5eckoaCi3FNPS4helFNEthk/Z7CD 1voZcu8az81OKWtJSiTM1L8hr0lskl4fRy6sxVtc3I9+vxCnPC+WOQcAVaKxh+E8GvdnDCRSEr9 ug893H+1Eod0aRTPVBW0BbLkWewLoUjgSeOLdWqk9puX4RmaPRcUIQ0bOMsMnSk06NCKQ0VEsiG z7EIGMKbDWkZxXuxALUdysPllMfmtpYrbrzddxt3KBMLKAzO015JUNcQWWFyNuQJxhbjKs9NAqG 4lipDVelhYOJCxcUwEKI9v3EPdqKehqquA/aM3Bru37CylplccKqUU2fm/cHhIC+Lnb+A3yAt4E Qo97cGuhlxkMLImDcKoFeW0CL88vuSv6yvmNjwAaVDizuOcUp0TF5u6lpliHZ4GqfEc+XaIR8f9 LQukw== X-Received: by 2002:a17:902:d48a:b0:2c9:aae1:a61a with SMTP id d9443c01a7336-2d5fd6fbe8bmr34571825ad.14.1787123996366; Wed, 19 Aug 2026 00:19:56 -0700 (PDT) Received: from hyunchul-PC02.lge.net ([27.122.242.71]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d5c1ee476bsm20833395ad.75.2026.08.19.00.19.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 00:19:55 -0700 (PDT) From: Hyunchul Lee To: Namjae Jeon Cc: Hyunchul Lee , ntfs@lists.linux.dev, rtm@csail.mit.edu, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH v2] ntfs: reject invalid MFT LCNs from boot sector Date: Wed, 19 Aug 2026 16:19:00 +0900 Message-ID: <20260819-fix-negative-mft-lcn-v2-1-ed9e0d3ee814@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-Mailer: b4 0.13.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2539; i=hyc.lee@gmail.com; h=from:subject:message-id; bh=a/O7jXZsnKbYL+CQh6l8K7m0G+bcoLnwdGb5IlUygRc=; b=owEBbQKS/ZANAwAKATTyMPr3jkjTAcsmYgBqhVecI4OSeGQI550f3CZhUIYaHNz3olNenYUUr VLEGbkB8a+JAjMEAAEKAB0WIQTVhSnMU3bjbW4eb2I08jD6945I0wUCaoVXnAAKCRA08jD6945I 09aND/9h2U+J3fZjkkKq6O0suhCRLvf4IUnRqUMfl+CaDiSlOrqtj9YMdRZf2d3gzqhOYX3/sRM cnX/I9TFlaXrgYD/sM6zQjTr4c2SWRHOzfFmQ55tf3NVx1ncIsg3Py8vBYIqX2AMKtmP9/mKn/k SdIG4Fw7/YrFZS2PqsdIDYAmU5tYv/eHG0dYOqKR5urfwUOkcKWRTn17mYbzZh1/oh2dy8eX8Xn r8IWgOxYF8yXWD/z+X7lbmf3hngkZJW1Z16JoYssZkzz8qReQiJ7ES+UUKXZJ7hQh+1iCXplBV/ S5zW8xXlDQ7LGaIymGc13aevBmlFdwBCQlm9dN+pLSVS7XH9xBmGSqHuOFgBqhDfgdwdXiHja7i ITg0VGzphLAU4SqNRXU7ycd7lAiEAiygg+MGQMKb/xEoRdHVjjj5hvgTnDmWgVZ7XDuKEUdgHkX QQyVeYcjB/mqV54dyIYlvvy/nVo8lhfANt0B1trpKbdwlTTs0m7m01NefDuVIbsZ7hQBGnbPABN 6D3qng8gX/wyCdibJyr5r37d4CaC2volvt0X7ClQ6rKHIeDocHZTIjYSBLgkDrNCznSoYzBaNq+ Hk5+0o5uadkpE+2wRBpcj3wJoDskIAE8FK4kk7tbS079QnXHQxT/sXiVZRNYMUHx9iRELyNNsuT hPs0czHiT3jCXfw== X-Developer-Key: i=hyc.lee@gmail.com; a=openpgp; fpr=D58529CC5376E36D6E1E6F6234F230FAF78E48D3 Content-Transfer-Encoding: quoted-printable The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parse_ntfs_boot_sector() decoded them into an s64. A crafted high-bit value could therefore become negative and pass the existing upper-bound check. The invalid value then propagated into the MFT zone allocator and could result in an out-of-bounds access to lcn_empty_bits_per_page. Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator") Reported-by: Robert Morris Closes: https://lore.kernel.org/all/57514.1787000602@localhost Cc: stable@vger.kernel.org Signed-off-by: Hyunchul Lee --- Changes in v2: * Change the pr_error format from "%lli" to "llu". * Add Reported-by tag. fs/ntfs/super.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c index 8abe7bee4c0d..cd8fa2c13370 100644 --- a/fs/ntfs/super.c +++ b/fs/ntfs/super.c @@ -645,7 +645,7 @@ static bool parse_ntfs_boot_sector(struct ntfs_volume *= vol, { unsigned int sectors_per_cluster, sectors_per_cluster_bits, nr_hidden_sec= ts; int clusters_per_mft_record, clusters_per_index_record; - s64 ll; + u64 ll; =20 vol->sector_size =3D le16_to_cpu(b->bpb.bytes_per_sector); vol->sector_size_bits =3D ffs(vol->sector_size) - 1; @@ -755,23 +755,23 @@ static bool parse_ntfs_boot_sector(struct ntfs_volume= *vol, * the same as it is much faster on 32-bit CPUs. */ ll =3D le64_to_cpu(b->number_of_sectors) >> sectors_per_cluster_bits; - if ((u64)ll >=3D 1ULL << 32) { + if (ll >=3D 1ULL << 32) { ntfs_error(vol->sb, "Cannot handle 64-bit clusters."); return false; } vol->nr_clusters =3D ll; ntfs_debug("vol->nr_clusters =3D 0x%llx", vol->nr_clusters); ll =3D le64_to_cpu(b->mft_lcn); - if (ll >=3D vol->nr_clusters) { - ntfs_error(vol->sb, "MFT LCN (%lli, 0x%llx) is beyond end of volume. We= ird.", + if (ll >=3D (u64)vol->nr_clusters) { + ntfs_error(vol->sb, "MFT LCN (%llu, 0x%llx) is beyond end of volume. We= ird.", ll, ll); return false; } vol->mft_lcn =3D ll; ntfs_debug("vol->mft_lcn =3D 0x%llx", vol->mft_lcn); ll =3D le64_to_cpu(b->mftmirr_lcn); - if (ll >=3D vol->nr_clusters) { - ntfs_error(vol->sb, "MFTMirr LCN (%lli, 0x%llx) is beyond end of volume.= Weird.", + if (ll >=3D (u64)vol->nr_clusters) { + ntfs_error(vol->sb, "MFTMirr LCN (%llu, 0x%llx) is beyond end of volume.= Weird.", ll, ll); return false; } --- base-commit: df7dce2090342170b7643d36f694204cae7792a9 change-id: 20260818-fix-negative-mft-lcn-596257dd23c8 Best regards, --=20 Thanks, Hyunchul