[PATCH] ntfs: fix u16 truncation of the update sequence array count check

[PATCH] ntfs: fix u16 truncation of the update sequence array count check

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xiaomi.com>

ntfs_check_restart_page_header() bounds the on-disk system page size by
recomputing the update sequence array count from it:

	u16 ra_ofs, usa_count, usa_ofs, usa_end = 0;
	...
	usa_count = 1 + (logfile_system_page_size >> NTFS_BLOCK_SIZE_BITS);
	if (usa_count != le16_to_cpu(rp->usa_count))
		return false;

The right hand side is computed in u32 but stored in a u16, so the count
wraps once the system page size reaches 0x2000000.  An image claiming any
larger power of two passes the check by also claiming usa_count == 1.

Nothing else limits the value, so ntfs_check_and_load_restart_page() goes
on to kvzalloc() up to 2 GiB for the restart page and copy that many bytes
a page at a time.  The size is only rejected afterwards, by the
(size >> NTFS_BLOCK_SIZE_BITS) != usa_count test in post_read_mst_fixup().

Compute the count in a u32 so the existing check rejects an over-large
system page size instead of being defeated by the truncation.  This adds
no new limit: the array holds one u16 per protected sector plus the update
sequence number and must end within the first sector, which caps usa_count
at 240 and the system page size at 64 KiB.

Widen ra_ofs and usa_ofs as well, as ntfs_check_restart_area() already
does: both are loaded from __le16 on-disk fields and every comparison is
against a non-negative value, so no result changes.

Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
 fs/ntfs/logfile.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ntfs/logfile.c b/fs/ntfs/logfile.c
index ce38ce87f8fc8..2f27ae7a3927f 100644
--- a/fs/ntfs/logfile.c
+++ b/fs/ntfs/logfile.c
@@ -27,7 +27,7 @@ static bool ntfs_check_restart_page_header(struct inode *vi,
 		struct restart_page_header *rp, s64 pos)
 {
 	u32 logfile_system_page_size, logfile_log_page_size;
-	u16 ra_ofs, usa_count, usa_ofs, usa_end = 0;
+	u32 ra_ofs, usa_count, usa_ofs, usa_end = 0;
 	bool have_usa = true;
 
 	ntfs_debug("Entering.");

base-commit: 19dc08f1f2c5563ba4da6afd5ecace8eba163aef
-- 
2.43.0

Re: [PATCH] ntfs: fix u16 truncation of the update sequence array count check

[Hyunchul Lee]

On Tue, Oct 20, 2026 at 09:44:33PM +0800, Zhan Xusheng wrote:
> From: Zhan Xusheng <zhanxusheng@xiaomi.com>
> 
> ntfs_check_restart_page_header() bounds the on-disk system page size by
> recomputing the update sequence array count from it:
> 
> 	u16 ra_ofs, usa_count, usa_ofs, usa_end = 0;
> 	...
> 	usa_count = 1 + (logfile_system_page_size >> NTFS_BLOCK_SIZE_BITS);
> 	if (usa_count != le16_to_cpu(rp->usa_count))
> 		return false;
> 
> The right hand side is computed in u32 but stored in a u16, so the count
> wraps once the system page size reaches 0x2000000.  An image claiming any
> larger power of two passes the check by also claiming usa_count == 1.
> 
> Nothing else limits the value, so ntfs_check_and_load_restart_page() goes
> on to kvzalloc() up to 2 GiB for the restart page and copy that many bytes
> a page at a time.  The size is only rejected afterwards, by the
> (size >> NTFS_BLOCK_SIZE_BITS) != usa_count test in post_read_mst_fixup().
> 
> Compute the count in a u32 so the existing check rejects an over-large
> system page size instead of being defeated by the truncation.  This adds
> no new limit: the array holds one u16 per protected sector plus the update
> sequence number and must end within the first sector, which caps usa_count
> at 240 and the system page size at 64 KiB.
> 
> Widen ra_ofs and usa_ofs as well, as ntfs_check_restart_area() already
> does: both are loaded from __le16 on-disk fields and every comparison is
> against a non-negative value, so no result changes.
> 
> Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>


Looks good to me.
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>

-- 
Thanks,
Hyunchul

Re: [PATCH] ntfs: fix u16 truncation of the update sequence array count check

[liubaolin]

在 2026/10/20 21:44, Zhan Xusheng 写道:
> From: Zhan Xusheng <zhanxusheng@xiaomi.com>
> 
> ntfs_check_restart_page_header() bounds the on-disk system page size by
> recomputing the update sequence array count from it:
> 
> 	u16 ra_ofs, usa_count, usa_ofs, usa_end = 0;
> 	...
> 	usa_count = 1 + (logfile_system_page_size >> NTFS_BLOCK_SIZE_BITS);
> 	if (usa_count != le16_to_cpu(rp->usa_count))
> 		return false;
> 
> The right hand side is computed in u32 but stored in a u16, so the count
> wraps once the system page size reaches 0x2000000.  An image claiming any
> larger power of two passes the check by also claiming usa_count == 1.
> 
> Nothing else limits the value, so ntfs_check_and_load_restart_page() goes
> on to kvzalloc() up to 2 GiB for the restart page and copy that many bytes
> a page at a time.  The size is only rejected afterwards, by the
> (size >> NTFS_BLOCK_SIZE_BITS) != usa_count test in post_read_mst_fixup().
> 
> Compute the count in a u32 so the existing check rejects an over-large
> system page size instead of being defeated by the truncation.  This adds
> no new limit: the array holds one u16 per protected sector plus the update
> sequence number and must end within the first sector, which caps usa_count
> at 240 and the system page size at 64 KiB.
> 
> Widen ra_ofs and usa_ofs as well, as ntfs_check_restart_area() already
> does: both are loaded from __le16 on-disk fields and every comparison is
> against a non-negative value, so no result changes.
> 
> Fixes: 1e9ea7e04472 ("Revert "fs: Remove NTFS classic"")
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
> ---
>   fs/ntfs/logfile.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/ntfs/logfile.c b/fs/ntfs/logfile.c
> index ce38ce87f8fc8..2f27ae7a3927f 100644
> --- a/fs/ntfs/logfile.c
> +++ b/fs/ntfs/logfile.c
> @@ -27,7 +27,7 @@ static bool ntfs_check_restart_page_header(struct inode *vi,
>   		struct restart_page_header *rp, s64 pos)
>   {
>   	u32 logfile_system_page_size, logfile_log_page_size;
> -	u16 ra_ofs, usa_count, usa_ofs, usa_end = 0;
> +	u32 ra_ofs, usa_count, usa_ofs, usa_end = 0;
>   	bool have_usa = true;
>   
>   	ntfs_debug("Entering.");
> 
> base-commit: 19dc08f1f2c5563ba4da6afd5ecace8eba163aef

 >

Looks good to me.

Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>