ntfs: prevent out-of-bounds write from a corrupt runlist

[PATCH] ntfs: prevent out-of-bounds write from a corrupt runlist

Posted by Dennis Tighe 1 month, 2 weeks ago

For the cluster bitmap ($Bitmap), __ntfs_bitmap_set_bits_in_run() uses a
cluster number as an index into vol->lcn_empty_bits_per_page[] via
ntfs_set_lcn_empty_bits(), with no upper bound on the index.  On the
deallocation path that cluster number is read from an on-disk runlist, so a
corrupted runlist naming a cluster beyond the end of the volume writes past
the end of the array into adjacent memory when a file is freed.

Reject cluster ranges outside the volume before updating the array,
mirroring the nr_clusters check already used in ntfs_trim_fs().

Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dennis Tighe <dennis.tighe@gmail.com>
---
  fs/ntfs/bitmap.c | 15 +++++++++++++++
  1 file changed, 15 insertions(+)

diff --git a/fs/ntfs/bitmap.c b/fs/ntfs/bitmap.c
index b1436b3..fb65bce 100644
--- a/fs/ntfs/bitmap.c
+++ b/fs/ntfs/bitmap.c
@@ -138,6 +138,21 @@ int __ntfs_bitmap_set_bits_in_run(struct inode *vi, 
const s64 start_bit,
      if (start_bit < 0 || cnt < 0 || value > 1)
          return -EINVAL;

+    /*
+     * For $Bitmap, @start_bit is a cluster number that comes from an
+     * on-disk runlist on the free path.  A corrupt runlist can name a
+     * cluster past the end of the volume and index
+     * vol->lcn_empty_bits_per_page[] out of bounds below, so reject it.
+     */
+    if (ni->mft_no == FILE_Bitmap &&
+        (start_bit >= vol->nr_clusters || cnt > vol->nr_clusters - 
start_bit)) {
+        ntfs_error(vi->i_sb,
+               "Cluster range (0x%llx+0x%llx) outside volume 0x%llx; 
corrupt runlist.",
+               (unsigned long long)start_bit, (unsigned long long)cnt,
+               (unsigned long long)vol->nr_clusters);
+        return -EIO;
+    }
+
      /*
       * Calculate the indices for the pages containing the first and last
       * bits, i.e. @start_bit and @start_bit + @cnt - 1, respectively.
-- 
2.47.3

Re: [PATCH] ntfs: prevent out-of-bounds write from a corrupt runlist

Posted by Hyunchul Lee 1 month, 1 week ago

Hi Dennis,

2026년 8월 15일 (토) 오후 3:41, Dennis Tighe <dennis.tighe@gmail.com>님이 작성:
>
> For the cluster bitmap ($Bitmap), __ntfs_bitmap_set_bits_in_run() uses a
> cluster number as an index into vol->lcn_empty_bits_per_page[] via
> ntfs_set_lcn_empty_bits(), with no upper bound on the index.  On the
> deallocation path that cluster number is read from an on-disk runlist, so a
> corrupted runlist naming a cluster beyond the end of the volume writes past
> the end of the array into adjacent memory when a file is freed.
>
> Reject cluster ranges outside the volume before updating the array,
> mirroring the nr_clusters check already used in ntfs_trim_fs().
>
> Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Dennis Tighe <dennis.tighe@gmail.com>
> ---
>   fs/ntfs/bitmap.c | 15 +++++++++++++++
>   1 file changed, 15 insertions(+)
>
> diff --git a/fs/ntfs/bitmap.c b/fs/ntfs/bitmap.c
> index b1436b3..fb65bce 100644
> --- a/fs/ntfs/bitmap.c
> +++ b/fs/ntfs/bitmap.c
> @@ -138,6 +138,21 @@ int __ntfs_bitmap_set_bits_in_run(struct inode *vi,
> const s64 start_bit,
>       if (start_bit < 0 || cnt < 0 || value > 1)
>           return -EINVAL;
>
> +    /*
> +     * For $Bitmap, @start_bit is a cluster number that comes from an
> +     * on-disk runlist on the free path.  A corrupt runlist can name a
> +     * cluster past the end of the volume and index
> +     * vol->lcn_empty_bits_per_page[] out of bounds below, so reject it.
> +     */

The runlist corruption is already rejected by
the preceding commit.

https://lore.kernel.org/all/20260811021548.15328-1-zenghongling@kylinos.cn/

> +    if (ni->mft_no == FILE_Bitmap &&
> +        (start_bit >= vol->nr_clusters || cnt > vol->nr_clusters -
> start_bit)) {
> +        ntfs_error(vi->i_sb,
> +               "Cluster range (0x%llx+0x%llx) outside volume 0x%llx;
> corrupt runlist.",
> +               (unsigned long long)start_bit, (unsigned long long)cnt,
> +               (unsigned long long)vol->nr_clusters);
> +        return -EIO;
> +    }
> +
>       /*
>        * Calculate the indices for the pages containing the first and last
>        * bits, i.e. @start_bit and @start_bit + @cnt - 1, respectively.
> --
> 2.47.3
>


-- 
Thanks,
Hyunchul