From nobody Mon Sep 28 21:03:30 2026 Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0005E44161B for ; Mon, 17 Aug 2026 15:18:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786979900; cv=none; b=Z+jOgKj+JSocbuSo4pH0vrFmYXU5ou5Dbr2i21iNIaksINaqUx9xvrI1ycvdOcMQsWvbpdFhMujYRoAaslqUlWaz84hHovVE+9nplAEGVOeqqW22c0sqsqBAyoFmNzxWLJOOELy5DUZDm+wsjbvKPwLQAajwaLzGIBFun1woVFg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786979900; c=relaxed/simple; bh=tCP9D0a5eyidqrerPu4jRVafCsdG/TkOdRzCzcE1AIU=; h=Message-ID:Date:MIME-Version:To:Cc:From:Subject:Content-Type; b=ShBG2QtkhdcvuCXimrFy6RkR+uKhHyohUUwx6Jt0uEjx5I39OniTScUAq82DfOcSzeHyTVm3pOe2yLYLkRynntz2ZiKOvdXM3f63GYDtpBZcTVdTLDCwWP5Fe0N7mq2jwUSHC1SvhqBEdNP68/BkWXVlZ4HI+cavgN+WpwaRgls= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WUQmUbmB; arc=none smtp.client-ip=209.85.215.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WUQmUbmB" Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-cbb7926836eso2463021a12.3 for ; Mon, 17 Aug 2026 08:18:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786979898; x=1787584698; darn=vger.kernel.org; h=content-transfer-encoding:content-type:subject:from:cc:to :content-language:user-agent:mime-version:date:message-id:from:to:cc :subject:date:message-id:reply-to:content-type; bh=KOjFRvjhVU8cFjkZuXZNJ83v2W6JcBfwkSkd8Ja0b2Q=; b=WUQmUbmBeqEq/m6Uev0lt+hTrDrYyGvUdSANEXw41rqZGbMnlrS4vIjTUgyOMbW1jG bCiR3Rfm6MyVCHlihc5DhNaFpG34UYsDWfirr1qvgVIZFkeTaQGtQtygQilAVDsYijPq 1cjKA0ZayHUN1xlzWWw9Ri/AvhibeTvb9rgMNrH2sLmOVMjA7MSBiYSStrgB8B9YIwg+ AxEhflYq3Soljx4aWnd8jBZZk3vznEZDVi7DrSXThadjpKesGP9JqqtUst7Gu8t/BGQn AfLCJXBuTzTkqq7z0JbSSLFS5BM2g3jIRlynAQdzEeSh++9E3+aBtDlgv3Sxq6mG+syb XJzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786979898; x=1787584698; h=content-transfer-encoding:content-type:subject:from:cc:to :content-language:user-agent:mime-version:date:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KOjFRvjhVU8cFjkZuXZNJ83v2W6JcBfwkSkd8Ja0b2Q=; b=bAEb+0EptgIhkQHghoxhl22WlONCII1bwEQ3tzYyb3Ty3YQ9kDbYrKx6f4AMa9vfj/ pSHyI7bOwbND/lzMzmpJNtt/WGGcFdFpzSGGsRsfbWedzCbB7JmagDFJHurmBYSAJNmj phV2IRBM20/QI2NH1bQVoWIvdV9+vW6jBeXjwxYmjmCCJ9azusTU0qhejSxkFnZFe02c m+AlxcCdkn8kVy+vt2wu5CcXbyKaCF8BiRCMR6EbwQuWYqWYbjC4s4DAkt+YfOETf8aL LRWAj3Y6epOqIDD9KJWp72sbVFpZwCbNpycxIgdNcJS6TAlrhCe+1/BZLevPCyiQ7sjY XdJg== X-Forwarded-Encrypted: i=1; AHgh+RoyVAIfEBnSkC5yXtdml1NnVVZAjpVie6OI1U1RYLF5//vYJuegtbxDEmxtKSr/bnGfROEd4D2o4AuRioU=@vger.kernel.org X-Gm-Message-State: AOJu0YxdQvG3vdpdKRb4omfwwNOyPxWeXexwpbR7aVBtrWq4gLd7G6cN AwiwRCv9rQA1ghnwQNHXCLDk4TAClaLaPiEGs9sdb6tBVKkdoXKdxCP2 X-Gm-Gg: AR+sD10RpQujecWLDX7DOGvhTdP68Z02O5UUIo5hVtUlOUxvAdpWELBRdnUsTQppJZ/ 0iWMeZHVIqlfFKwIi3NbRRUw/uzSqskkiO7ZH5n9KbHidBCMTnVZNAkquLbAwxe7IWSayaGLwm2 y3N7zc7BUtHdFqFUhuZfpkRh+jHaMpApSLh6SZym0kXM3o2iyH7SbJXmtFG5b5YjjCY8/qzoexC Dj2efUvDeqGChm6Utl4p8MsXfMkVa3C7BBrorDuMTqkln6I8xy3/eh+ZknEErzqzYjIRLblZYCP W3WbXGmrDxaNQaxa07Gk+xJfuTTptOS+eLFbJQ4mWCJWnLwGjxiJIQJ7/3VduUpNxgqKmj7OytJ UEiRti6WGq0l27htaEsNIpIqVAVDuWnkFoNYWLmt1eQNTTpgdBiLGGoeTEYtPOcnuwW9jpri1oH 9hE0B3X/BkUVs2YE5VdX+5Fk6cYxGQXvnPcAOm/TgIsQ/yE8vHN1l9t3jVoUDpwWeIYFFcGpQ9H 89Z2LjfSUhe3A+9RmG6Rx3Rp9IjqQjpUQ3QE6Vmgfsic9+82gbUCRemuPPF2K+D X-Received: by 2002:a05:6a21:3293:b0:3c3:7a0a:18a6 with SMTP id adf61e73a8af0-3cc71fa8631mr23752235637.18.1786979898025; Mon, 17 Aug 2026 08:18:18 -0700 (PDT) Received: from [10.0.1.166] (75-172-9-230.tukw.qwest.net. [75.172.9.230]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cc13c03320esm927521a12.25.2026.08.17.08.18.17 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 17 Aug 2026 08:18:17 -0700 (PDT) Message-ID: <6a01e914-db1f-476b-a371-170e3b179bea@gmail.com> Date: Mon, 17 Aug 2026 08:18:15 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: Namjae Jeon , Hyunchul Lee Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org From: Dennis Tighe Subject: [PATCH] ntfs: fix off-by-one page overflow in ntfs_decompress() Content-Type: text/plain; charset="utf-8"; format="flowed" Content-Transfer-Encoding: quoted-printable The per-token range check in ntfs_decompress() uses =C2=A0 =C2=A0 if (cb >=3D cb_sb_end || dp_addr > dp_sb_end) =C2=A0 =C2=A0 =C2=A0 =C2=A0 break; so dp_addr =3D=3D dp_sb_end falls through to the symbol copy `*dp_addr++ =3D *cb++`, writing one byte past the destination page. Since NTFS_SB_SIZE =3D=3D PAGE_SIZE the destination is a single page, so the byte lands in the adjacent page, and *dest_ofs is left one past the sub-block end (the later `*dest_ofs &=3D ~PAGE_MASK` then yields 1, not 0, so the page is never finalized and later sub-blocks keep writing further past it).=C2= =A0 A corrupted compressed $DATA attribute then produces a bounded run of out-of-bounds writes when the file is read. The fix is to break as soon as dp_addr reaches dp_sb_end; a full sub-block still completes, as its final copy advances dp_addr to exactly dp_sb_end. Fixes: 1e9ea7e04472 ("Revert \"fs: Remove NTFS classic\"") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Dennis Tighe Reviewed-by: Hyunchul Lee --- Reproducer is available on request if needed for validation. I was able to craft an imagine that would exercise this scenario leading to KASAN UAF errors on read-only mounts. =C2=A0fs/ntfs/compress.c | 2 +- =C2=A01 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ntfs/compress.c b/fs/ntfs/compress.c index 76bd806b41e..dc5ad951dc6 100644 --- a/fs/ntfs/compress.c +++ b/fs/ntfs/compress.c @@ -352,7 +352,7 @@ static int ntfs_decompress(struct page=20 *dest_pages[], int completed_pages[], =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0u8 *dp_back_addr; =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* Check if we are done / still in range= . */ -=C2=A0 =C2=A0 =C2=A0 =C2=A0 if (cb >=3D cb_sb_end || dp_addr > dp_sb_end) +=C2=A0 =C2=A0 =C2=A0 =C2=A0 if (cb >=3D cb_sb_end || dp_addr >=3D dp_sb_en= d) =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0break; =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* Determine token type and parse approp= riately.*/ --=20 2.47.3